CVE-2022-22963
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Published Apr 1, 2022 · updated Jun 16, 2026 · vmware spring cloud function
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Timeline
Detection, updates, and resolution for this record.
Apr 1, 2022 · Catalog
Detected
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Aug 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Sep 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Required action
Apply updates per vendor instructions.
CISA due date Sep 15, 2022
Affected
- cpe oracle/banking branch14.5
- cpe oracle/banking cash management14.5
- cpe oracle/banking corporate lending process management14.5
- cpe oracle/banking credit facilities process management14.5
- cpe oracle/banking electronic data exchange for corporates14.5
- cpe oracle/banking liquidity management14.2
- cpe vmware/spring cloud functionversion unspecified
- vendor VMware Tanzu Spring Cloudversion unspecified
Sources
- CISA KEVCVE-2022-22963
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
cisa.gov - CVE.orgCVE-2022-22963
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-22963
30-day exploitation probability 99.9%
first.org - Exploit Database51577
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/spring_cloud_function_spel_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2022-22963
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
nvd.nist.gov