CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Vulnerability summary
CVE-2022-22963 is a critical (CVSS 9.8) Code Injection vulnerability in VMware Tanzu Spring Cloud. It is known to be exploited: CISA lists it, first on 25-08-2022. EPSS estimates a 99.94% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 01-04-2022PublishedVulnerability first disclosed.
- 25-08-2022Added to CISA KEVVMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
- 15-09-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.94%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.94% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 25-08-2022
- Federal due date
- 15-09-2022
CISA required action
Apply updates per vendor instructions. tanzu.vmware.com/security/cve-2022-22963 nvd.nist.gov/vuln/detail/CVE-2022-22963
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Spring Cloud 3.2.2 - Remote Command Execution (RCE)
Maturity: poc
Spring Cloud Function SpEL Injection
exploit/multi/http/spring_cloud_function_spel_injection
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Affected systems
Oracle27 products
- banking_branch14.5
- banking_cash_management14.5
- banking_corporate_lending_process_management14.5
- banking_credit_facilities_process_management14.5
- banking_electronic_data_exchange_for_corporates14.5
Org.springframework.cloud1 product
- spring-cloud-function-context≥ 3.2.0, < 3.2.3 | < 3.1.7
Redhat1 product
- openshift-serverless-clients< 0:1.0.1-2.el8
Vmware1 product
- spring_cloud_function≤ 3.1.6 | ≥ 3.2.0, ≤ 3.2.2
4 vendors · 30 products
References
22 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxHVendor AdvisoryWEBThird Party Advisory
- packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.htmlWEBExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963Government ResourceWEBUS Government Resource
