Tracker / CVE-2022-22947
CVE-2022-22947
Exploited Critical 10.0
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Affected products and versions
| oracle | commerce_guided_search |
|---|---|
| oracle | communications_cloud_native_core_binding_support_function |
| oracle | communications_cloud_native_core_console |
| oracle | communications_cloud_native_core_network_exposure_function |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment |
| oracle | communications_cloud_native_core_network_repository_function |
| oracle | communications_cloud_native_core_network_slice_selection_function |
| oracle | communications_cloud_native_core_security_edge_protection_proxy |
| oracle | communications_cloud_native_core_service_communication_proxy |
| vmware | spring_cloud_gateway |
| vmware | spring_cloud_gateway · … → 3.0.7 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.