Every CVE Search/ Get API key

CVE-2022-22947

Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

10.0 CriticalIn KEVPublic exploitFix available

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

98.3%Up 91.6 points since Mar 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Record
CVE-2022-22947
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-94, CWE-917
Updated
2026-11-02
CVE List 10.0

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Record
CVE-2022-22947
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2022-1288 10.0

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Record
EUVD-2022-1288
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-3gx9-37ww-9qw6 10.0

Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.

Record
GHSA-3gx9-37ww-9qw6
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94, CWE-917
Updated
2026-11-02
CISA KEV No score

VMware Spring Cloud Gateway Code Injection Vulnerability

Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

Record
CVE-2022-22947
Weakness
CWE-94
Updated
2026-11-02
OSV 10.0

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Record
CVE-2022-22947
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-3gx9-37ww-9qw6 10.0

Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.

Record
GHSA-3gx9-37ww-9qw6
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-917, CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.springframework.cloud:spring-cloud-gateway
Maven
 before 3.0.7
3.0.7
org.springframework.cloud:spring-cloud-gateway
Maven
 3.1.0 up to 3.1.1
3.1.1
org.springframework.cloud:spring-cloud-gateway
Maven
 before 3.0.7, plus listed versions
1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE2.0.0.RELEASE
Show 28 moreShow less
2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.3.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.10.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.2.5.RELEASE2.2.6.RELEASE2.2.7.RELEASE2.2.8.RELEASE2.2.9.RELEASE3.0.03.0.13.0.23.0.33.0.43.0.53.0.6
3.0.7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitSpring Cloud Gateway Remote Code Execution2022-01-26
PoC in GitHublucksec/Spring-Cloud-Gateway-CVE-2022-229472022-03-02
PoC in GitHubSecNN/CVE-2022-22947_Rce_Exp2022-03-03
PoC in GitHubTas9er/SpringCloudGatewayRCE2022-03-03
PoC in GitHubVulnmachines/spring-cve-2022-229472022-03-03
PoC in GitHubcrowsec-edtech/CVE-2022-229472022-03-03
PoC in GitHubscopion/cve-2022-229472022-03-03
PoC in GitHubBerMalBerIst/CVE-2022-229472022-03-04
PoC in GitHubGreetdawn/CVE-2022-229472022-03-04
PoC in GitHubSummer177/Spring-Cloud-Gateway-CVE-2022-229472022-03-04
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubdbgee/CVE-2022-229472022-03-04
PoC in GitHubdingxiao77/-cve-2022-22947-2022-03-04
PoC in GitHubflying0er/CVE-2022-22947-goby2022-03-04
PoC in GitHubhunzi0/CVE-2022-22947-Rce_POC2022-03-04
PoC in GitHubnanaao/CVE-2022-22947-POC2022-03-04
PoC in GitHubnu0l/cve-2022-229472022-03-04
PoC in GitHubtangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway2022-03-04
PoC in GitHub22ke/CVE-2022-229472022-03-05
Exploit-DBSpring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)2022-03-07
PoC in GitHubJun-5heng/CVE-2022-229472022-03-07
PoC in GitHubMoCh3n/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE2022-03-07
PoC in GitHubYutuSec/SpEL2022-03-07
PoC in GitHubdarkb1rd/cve-2022-229472022-03-07
PoC in GitHubmrknow001/CVE-2022-229472022-03-07
PoC in GitHub0x7eTeam/CVE-2022-229472022-03-08
PoC in GitHubArrnitage/CVE-2022-22947_exp2022-03-10
PoC in GitHubPaoPaoLong-lab/Spring-CVE-2022-22947-2022-03-10
NucleiSpring Cloud Gateway Code Injection

Plus 37 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-22947 is a critical vulnerability (CVSS 10.0) in Vmware Spring Cloud Gateway, published March 3, 2022. CISA lists it as known to be exploited, since May 16, 2022. EUVD reports exploitation since May 16, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.3%, the 99th percentile. Fixed in org.springframework.cloud:spring-cloud-gateway 3.0.7.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open