CVE-2022-22947
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
CVE-2022-22947 is a critical vulnerability (CVSS 10.0) in Vmware Spring Cloud Gateway, published March 3, 2022. CISA lists it as known to be exploited, since May 16, 2022. EUVD reports exploitation since May 16, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.3%, the 99th percentile. Fixed in org.springframework.cloud:spring-cloud-gateway 3.0.7.
- Severity
- 10.0 CriticalCVSS 3.1, NVD
- Exploit chance
- 98.3%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
Description
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- vmware spring cloud gateway
- oracle commerce guided search
- oracle communications cloud native core binding support function
- oracle communications cloud native core console
- oracle communications cloud native core network exposure function
- oracle communications cloud native core network function cloud native environment
- oracle communications cloud native core network repository function
- oracle communications cloud native core network slice selection function
- oracle communications cloud native core security edge protection proxy
- oracle communications cloud native core service communication proxy
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-gatewayMaven | before 3.0.7 | 3.0.7 |
org.springframework.cloud:spring-cloud-gatewayMaven | 3.1.0 up to 3.1.1 | 3.1.1 |
org.springframework.cloud:spring-cloud-gatewayMaven | before 3.0.7, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE2.0.0.RELEASE Show 28 moreShow less2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.3.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.10.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.2.5.RELEASE2.2.6.RELEASE2.2.7.RELEASE2.2.8.RELEASE2.2.9.RELEASE3.0.03.0.13.0.23.0.33.0.43.0.53.0.6 | 3.0.7 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Spring Cloud Gateway Remote Code Execution | 2022-01-26 |
| PoC in GitHub | lucksec/Spring-Cloud-Gateway-CVE-2022-22947 | 2022-03-02 |
| PoC in GitHub | SecNN/CVE-2022-22947_Rce_Exp | 2022-03-03 |
| PoC in GitHub | Tas9er/SpringCloudGatewayRCE | 2022-03-03 |
| PoC in GitHub | Vulnmachines/spring-cve-2022-22947 | 2022-03-03 |
| PoC in GitHub | crowsec-edtech/CVE-2022-22947 | 2022-03-03 |
| PoC in GitHub | scopion/cve-2022-22947 | 2022-03-03 |
| PoC in GitHub | BerMalBerIst/CVE-2022-22947 | 2022-03-04 |
| PoC in GitHub | Greetdawn/CVE-2022-22947 | 2022-03-04 |
| PoC in GitHub | Summer177/Spring-Cloud-Gateway-CVE-2022-22947 | 2022-03-04 |
Show 18 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dbgee/CVE-2022-22947 | 2022-03-04 |
| PoC in GitHub | dingxiao77/-cve-2022-22947- | 2022-03-04 |
| PoC in GitHub | flying0er/CVE-2022-22947-goby | 2022-03-04 |
| PoC in GitHub | hunzi0/CVE-2022-22947-Rce_POC | 2022-03-04 |
| PoC in GitHub | nanaao/CVE-2022-22947-POC | 2022-03-04 |
| PoC in GitHub | nu0l/cve-2022-22947 | 2022-03-04 |
| PoC in GitHub | tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway | 2022-03-04 |
| PoC in GitHub | 22ke/CVE-2022-22947 | 2022-03-05 |
| Exploit-DB | Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE) | 2022-03-07 |
| PoC in GitHub | Jun-5heng/CVE-2022-22947 | 2022-03-07 |
| PoC in GitHub | MoCh3n/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE | 2022-03-07 |
| PoC in GitHub | YutuSec/SpEL | 2022-03-07 |
| PoC in GitHub | darkb1rd/cve-2022-22947 | 2022-03-07 |
| PoC in GitHub | mrknow001/CVE-2022-22947 | 2022-03-07 |
| PoC in GitHub | 0x7eTeam/CVE-2022-22947 | 2022-03-08 |
| PoC in GitHub | Arrnitage/CVE-2022-22947_exp | 2022-03-10 |
| PoC in GitHub | PaoPaoLong-lab/Spring-CVE-2022-22947- | 2022-03-10 |
| Nuclei | Spring Cloud Gateway Code Injection |
What each source reports
NVD Score used
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- Record
CVE-2022-22947- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94, CWE-917
- Updated
- 2026-11-02
CVE List
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- Record
CVE-2022-22947- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2022-1288
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- Record
EUVD-2022-1288- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3gx9-37ww-9qw6
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
- Record
GHSA-3gx9-37ww-9qw6- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94, CWE-917
- Updated
- 2026-11-02
CISA KEVNo score
VMware Spring Cloud Gateway Code Injection Vulnerability
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
- Record
CVE-2022-22947- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- Record
CVE-2022-22947- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-3gx9-37ww-9qw6
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
- Record
GHSA-3gx9-37ww-9qw6- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-917, CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| exploits, exploits_more | ||
| exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
tanzu.vmware.com/security/cve-2022-22947
oracle.com/security-alerts/cpuapr2022.html
packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22947
nvd.nist.gov/vuln/detail/CVE-2022-22947
github.com/advisories/GHSA-3gx9-37ww-9qw6
The full exploit list has 37 more links.