What’s Vulnerable › Vulnerabilities

CVE-2022-23464: Potential Server Side Request Forgery (SSRF) in Nepxion Discovery

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-24 · updated 2026-06-17
• Weakness: CWE-918

Description

Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.

Affected products

• Nepxion Discover: through 6.16.2

References

• https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery/
• https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery/

Get alerted when CVE-2022-23464 or the next vulnerability affects your stack