CVE Intelligence
Analysis AI-assisted

CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability

CVE-2022-22947 is a critical code injection flaw (CWE-917, Expression Language Injection) in VMware Spring Cloud Gateway when the Gateway Actuator endpoint is enabled, exposed and unsecured. The record reports a CVSS 3.1 base score of 10 and that the issue is listed in the CISA KEV catalog. Administrators should upgrade to the fixed versions listed by the sources and restrict access to the Actuator endpoint.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2022-22947 affects VMware Spring Cloud Gateway. According to the record, applications are vulnerable to code injection when the Gateway Actuator endpoint is enabled, exposed and unsecured. The weakness is classified as CWE-917, Expression Language Injection. The NVD entry was published on 2022-03-03.

Impact

  • The record describes a remote attacker sending a crafted request that could allow arbitrary remote execution on the host.
  • The CVSS 3.1 vector reported by NVD is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with a base score of 10 (critical).
  • SSVC data in the record marks exploitation as active, automatable as yes and technical impact as total.

Affected products and versions

The record lists several products. The Spring-related entries are:

  • VMware Spring Cloud Gateway: version 3.1.0 and versions below 3.0.7.
  • Maven org.springframework.cloud:spring-cloud-gateway: versions below 3.0.7 and versions from 3.1.0 up to, but not including, 3.1.1.

The fixed versions given in the record are 3.0.7 and 3.1.1 for the Maven artifact, as referenced by GitHub Security Advisory GHSA-3gx9-37ww-9qw6. The record also lists several Oracle Communications and Oracle Commerce products that depend on the affected component; consult the Oracle security alerts for their specific fixes.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog lists this CVE, with a date added of 2022-05-16 and a due date of 2022-06-06, so active exploitation is confirmed by that source. The record also indicates a very high EPSS probability score. Two public exploit-related entries appear in the references from Packet Storm Security; their content was not reviewed here and no exploit details are reproduced in this analysis.

Remediation and mitigation

  • Upgrade Spring Cloud Gateway to a fixed version: 3.0.7 or later on the 3.0.x line, or 3.1.1 or later on the 3.1.x line, as stated in the record.
  • Review the VMware Tanzu security advisory for vendor mitigation guidance: VMware Tanzu CVE-2022-22947.
  • Apply the Oracle Critical Patch Update fixes for the Oracle products listed as affected: Oracle April 2022 CPU and Oracle July 2022 CPU.
  • Restrict or secure the Gateway Actuator endpoint so it is not exposed or left unauthenticated, as the vulnerable condition depends on this configuration.

Detection guidance

  • Inventory applications that use Spring Cloud Gateway and identify the version of the spring-cloud-gateway dependency.
  • Check whether the Gateway Actuator endpoint is enabled, reachable from untrusted networks and lacking authentication.
  • Review web and gateway logs for unusual requests targeting Actuator paths, and monitor for unexpected process or command activity on affected hosts.

Limitations of the available information

  • The record does not describe the exact request format or internal mechanics, and this analysis does not include them.
  • Not all affected Oracle product versions are fully explained by the record; their remediation status should be confirmed with Oracle.
  • The record's EPSS date is 2026-10-13, which should be treated as the date of that score rather than as a verified current value.
  • Whether the ransomware_use field (Unknown) reflects any campaign is not established by the record.

Frequently asked questions

Which versions are fixed?

The record lists 3.0.7 and 3.1.1 as fixed versions for the Maven spring-cloud-gateway artifact, referenced from GitHub advisory GHSA-3gx9-37ww-9qw6.

Is this vulnerability being exploited?

Yes, according to the record it is listed in the CISA Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild.

What configuration makes the system vulnerable?

The record states that the issue applies when the Gateway Actuator endpoint is enabled, exposed and unsecured.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.