In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Connections 29
has cited scope1 retained · stored CVE-2022-22963 → n/a · Spring Cloud Function56e2e11b-c062-40dd-992e-a0444755dd48
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_console320f2019-d9df-4cc0-a439-499aba3bb29f5c8d72f5-58dc-4acb-ad90-99dbb46c2772
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · communications_communications_policy_management93deeb0c-6eee-4a8f-b421-c3e4457c5a48
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_unified_data_repository74008a5a-ed43-40e7-aeed-4300437aa9e8960e18a8-ed6d-44c3-9805-c2a01363b875
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_corporate_lending_process_management9b871115-89c9-4b62-8188-7cdded9317fd
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_automated_test_suite223ed10e-6b5d-465e-9a2d-c4f67bd77efb483a5a75-0613-4847-8413-6e2c9ff6c23e
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_supply_chain_finance22eb38cf-cc4f-4073-bc49-c33a8d849c45
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · sd-wan_edge5d3e1338-ec63-428f-a735-c57cb308c87f669a6226-4643-4d58-a830-97e48d13b7c2
has vulnerable target scope3 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_policy12e70290-8c78-4f2e-ac1b-1abb4f6c84cb15455607-7809-4efc-a412-6e1940c05d8024cb9e4a-209b-4f99-b660-b4e23281eb07
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_credit_facilities_process_management20d8cd33-d538-4c2c-bb6b-853e8ae3e6c4
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_origination40f253c4-3933-4974-b15a-4762fbba7087
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · mysql_enterprise_monitor936d76f3-781c-426c-9a12-c5d0725de97c
has vulnerable target scope3 retained · stored CVE-2022-22963 → oracle · financial_services_behavior_detection_platform17e98fe0-9889-44cf-8bc7-200ec40bde614c60fc06-ef5f-46f8-bc28-a8f5dd2415ca82fe86fe-94aa-4935-ac15-895db0766373
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_network_repository_function679b8920-bdd2-46c5-86c0-f79b053a995fd8e2c98c-21e5-41a0-81ad-b08a48b50150
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · banking_liquidity_management53da3572-8307-4d31-9783-d9e9e7ae332f660f2c81-b1eb-42f1-be72-754f0f300f7e
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_electronic_data_exchange_for_corporates2792bd2c-7258-4bda-ab60-0657ed60b2cc
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · product_lifecycle_analytics381ac582-4433-41d3-bacc-5affa39d915a
has vulnerable target scope3 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_network_function_cloud_native_environment378bce48-a934-4404-b8ad-349a2982172947e96861-20c7-4f00-8790-741c49b4040c65c378eb-06f6-4ed2-85e3-a69ccf4be534
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_network_exposure_function3a4ce5db-5d7b-4e53-ab73-2f25a71dbd5c
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_cash_management338768a2-8971-4005-9e22-9739508fbc45
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · financial_services_analytical_applications_infrastructure17aa2177-a32b-4fd1-a9a3-ab68a4a623271a7d5d99-0b95-43d5-82c2-0b1edbba842c
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · retail_xstore_point_of_service1c6c25e8-1546-4789-b9f1-63e652ac6f30cdf6d0cf-0a43-4898-8a91-c324090b41de
has vulnerable target scope3 retained · stored CVE-2022-22963 → oracle · financial_services_enterprise_case_management2bb5b7af-582c-4a59-bd2b-3372e03364ff45560748-337c-4301-a589-367cd246eb4dd16a1a45-7c08-4f98-8063-af1fcf93eaf8
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_branch9c9e626c-0886-432b-a1b6-694a73f191e5
has vulnerable target scope2 retained · stored CVE-2022-22963 → vmware · spring_cloud_function58148847-2ab0-4c6c-9264-d0cd5efb009d92b92210-b8d1-4941-bcc3-5a7c0cd09ec5
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_virtual_account_management5a8beb9a-9e31-4067-b69c-a78859d81ce7
has vulnerable target scope1 retained · stored CVE-2022-22963 → oracle · banking_trade_finance_process_managemente5add855-65e2-4638-82a6-99b6d2151bb7
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_network_slice_selection_functionc0e7ad50-5188-49fd-aa70-38b16182551dfc15bed7-3dc8-4b44-9117-3acd0b5af79b
has vulnerable target scope2 retained · stored CVE-2022-22963 → oracle · communications_cloud_native_core_security_edge_protection_proxy22470c38-7323-492f-ab71-c30ff33d1f22fd22c560-d03d-4c29-88cb-e8eaae710492