Every CVE Search/ Get API key

CVE-2022-22963

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

9.8 CriticalIn KEVPublic exploitFix available

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 66.7 points since Apr 2, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
CVE-2022-22963
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94, CWE-917
Updated
2026-11-02
CVE List 9.8

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
CVE-2022-22963
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2022-1654 9.8

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
EUVD-2022-1654
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6v73-fgf6-w5j7 9.8

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
GHSA-6v73-fgf6-w5j7
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94, CWE-917
Updated
2026-11-02
CISA KEV No score

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
CVE-2022-22963
Weakness
CWE-94
Updated
2026-11-02
OSV 9.8

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
CVE-2022-22963
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-6v73-fgf6-w5j7 9.8

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Record
GHSA-6v73-fgf6-w5j7
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-917, CWE-94
Updated
2026-11-02
OSVRHSA-2022:1291 9.8

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.21.1

Record
RHSA-2022:1291
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Show 17 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.springframework.cloud:spring-cloud-function-context
Maven
 3.2.0 up to 3.2.3
3.2.3
org.springframework.cloud:spring-cloud-function-context
Maven
 before 3.1.7
3.1.7
org.springframework.cloud:spring-cloud-function-context
Maven
 3.2.0 up to 3.2.3, plus listed versions
3.2.13.2.2
3.2.3
org.springframework.cloud:spring-cloud-function-context
Maven
 before 3.1.7, plus listed versions
1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE2.0.0.RELEASE2.0.1.RELEASE
Show 25 moreShow less
2.0.2.RELEASE2.1.0.RELEASE2.1.1.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.10.RELEASE3.0.11.RELEASE3.0.12.RELEASE3.0.13.RELEASE3.0.14.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.0.9.RELEASE3.1.03.1.13.1.23.1.33.1.43.1.53.1.6
3.1.7
openshift-serverless-clients
Red Hat:serverless:1.0::el8
 before 0:1.0.1-2.el8
0:1.0.1-2.el8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubhktalent/spring-spel-0day-poc2022-03-26
MetasploitSpring Cloud Function SpEL Injection2022-03-29
PoC in GitHubKirill89/CVE-2022-22963-PoC2022-03-30
PoC in GitHubRanDengShiFu/CVE-2022-229632022-03-30
PoC in GitHubdarryk10/CVE-2022-229632022-03-30
PoC in GitHubdinosn/CVE-2022-229632022-03-30
PoC in GitHubstevemats/Spring0DayCoreExploit2022-03-30
PoC in GitHubkh4sh3i/Spring-CVE2022-03-31
PoC in GitHubme2nuk/CVE-2022-229632022-03-31
PoC in GitHubpuckiestyle/CVE-2022-229632022-03-31
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubAayushmanThapaMagar/CVE-2022-229632022-04-01
PoC in GitHubtwseptian/cve-2022-229632022-04-03
PoC in GitHubSealPaPaPa/SpringCloudFunction-Research2022-04-05
PoC in GitHubG01d3nW01f/CVE-2022-229632022-04-11
PoC in GitHubk3rwin/spring-cloud-function-rce2022-04-14
PoC in GitHubiliass-dahman/CVE-2022-22963-POC2023-01-15
PoC in GitHubcharis3306/CVE-2022-229632023-03-07
PoC in GitHublemmyz4n3771/CVE-2022-22963-PoC2023-03-13
PoC in GitHubJ0ey17/CVE-2022-22963_Reverse-Shell-Exploit2023-03-18
PoC in GitHubMustafa1986/CVE-2022-229632023-03-21
PoC in GitHubSourM1lk/CVE-2022-22963-Exploit2023-04-10
PoC in GitHubrandallbanner/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCE2023-04-17
PoC in GitHubgunzf0x/CVE-2022-229632023-05-03
PoC in GitHubnikn0laty/RCE-in-Spring-Cloud-CVE-2022-229632023-05-25
Exploit-DBSpring Cloud 3.2.2 - Remote Command Execution (RCE)2023-07-11
PoC in GitHubBearClaw96/CVE-2022-22963-Poc-Bearcules2023-10-28
PoC in GitHubxmqaq/CVE-2022-229632023-12-28
NucleiSpring Cloud - Remote Code Execution

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-22963 is a critical vulnerability (CVSS 9.8) in Vmware Spring Cloud Function, published April 1, 2022. CISA lists it as known to be exploited, since August 25, 2022. EUVD reports exploitation since August 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. Fixed in org.springframework.cloud:spring-cloud-function-context 3.2.3.

References

Show 18 moreShow less
This page doesn't list everything

The full exploit list has 5 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open