What’s Vulnerable › Vulnerabilities

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-08-25
• EPSS: 99.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-01 · updated 2026-06-17
• Weakness: CWE-94

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Affected products

• Oracle Banking Branch: 14.5
• Oracle Banking Cash Management: 14.5
• Oracle Banking Corporate Lending Process Management: 14.5
• Oracle Banking Credit Facilities Process Management: 14.5
• Oracle Banking Electronic Data Exchange For Corporates: 14.5
• Oracle Corporation Oracle Banking Liquidity Management: 14.2, 14.5
• Oracle Corporation Oracle Banking Origination: 14.5
• Oracle Banking Supply Chain Finance: 14.5
• Oracle Corporation Oracle Banking Trade Finance Process Management: 14.5
• Oracle Corporation Banking Virtual Account Management: 14.5
• Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0, 22.1.0
• Oracle Communications Cloud Native Core Console: 1.9.0, 22.1.0
• Oracle Communications Cloud Native Core Network Exposure Function: 22.1.0
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0, 22.1.0, 22.1.2
• Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 22.1.0
• Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0, 22.1.0
• Oracle Communications Cloud Native Core Policy: 1.15.0, 22.1.0, 22.1.3
• Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.7.0, 22.1.0
• Oracle Communications Cloud Native Core Unified Data Repository: 1.15.0, 22.1.0
• Oracle Communications Communications Policy Management: 12.6.0.0.0
• Oracle Corporation Financial Services Analytical Applications Infrastructure: 8.1.1.0, 8.1.2.0
• Oracle Corporation Financial Services Behavior Detection Platform: 8.1.1.0, 8.1.1.1, 8.1.2.0
• Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.1.1.0, 8.1.1.1, 8.1.2.0
• Oracle Corporation MySQL Enterprise Monitor: through 8.0.29
• Oracle Corporation Oracle Product Lifecycle Analytics: 3.6.1.0
• Oracle Corporation Retail Xstore Point of Service: 20.0.1, 21.0.0
• Oracle Corporation SD-WAN Edge: 9.0, 9.1
• Spring Cloud Function: through 3.1.6; from 3.2.0 through 3.2.2
• Spring Cloud Function: Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions

References

• http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
• https://tanzu.vmware.com/security/cve-2022-22963
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
• https://tanzu.vmware.com/security/cve-2022-22963
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2022-22963 or the next vulnerability affects your stack