CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Sep 15, 2022

High

CISA KEV

CVE-2022-22963

VMware Tanzu—Spring Cloud

When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Required Action

https://tanzu.vmware.com/security/cve-2022-22963; https://nvd.nist.gov/vuln/detail/CVE-2022-22963

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Aug 25, 2022
KEV Added: Aug 25, 2022
Due Date: Sep 15, 2022
Related Articles: 0

Vendor

VMware Tanzu

Spring Cloud