{"id":"CVE-2022-22947","aliases":["EUVD-2022-1288","GHSA-3gx9-37ww-9qw6"],"status":"published","title":"Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.98253,"percentile":0.99916,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-917","CWE-94"],"published":"2022-03-03T00:00:00Z","modified":"2026-10-28T02:30:34Z","kev":{"date_added":"2022-05-16","due_date":"2022-06-06","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-05-16"},{"source":"kev","since":"2022-05-16"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/spring_cloud_gateway_rce","title":"Spring Cloud Gateway Remote Code Execution","type":"exploit","platform":"Linux,Unix","date":"2022-01-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/spring_cloud_gateway_rce"},{"source":"pocgithub","id":"lucksec/Spring-Cloud-Gateway-CVE-2022-22947","title":"lucksec/Spring-Cloud-Gateway-CVE-2022-22947","date":"2022-03-02","url":"https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947"},{"source":"pocgithub","id":"SecNN/CVE-2022-22947_Rce_Exp","title":"SecNN/CVE-2022-22947_Rce_Exp","date":"2022-03-03","url":"https://github.com/SecNN/CVE-2022-22947_Rce_Exp"},{"source":"pocgithub","id":"Tas9er/SpringCloudGatewayRCE","title":"Tas9er/SpringCloudGatewayRCE","date":"2022-03-03","url":"https://github.com/Tas9er/SpringCloudGatewayRCE"},{"source":"pocgithub","id":"Vulnmachines/spring-cve-2022-22947","title":"Vulnmachines/spring-cve-2022-22947","date":"2022-03-03","url":"https://github.com/Vulnmachines/spring-cve-2022-22947"},{"source":"pocgithub","id":"crowsec-edtech/CVE-2022-22947","title":"crowsec-edtech/CVE-2022-22947","date":"2022-03-03","url":"https://github.com/crowsec-edtech/CVE-2022-22947"},{"source":"pocgithub","id":"scopion/cve-2022-22947","title":"scopion/cve-2022-22947","date":"2022-03-03","url":"https://github.com/scopion/cve-2022-22947"},{"source":"pocgithub","id":"BerMalBerIst/CVE-2022-22947","title":"BerMalBerIst/CVE-2022-22947","date":"2022-03-04","url":"https://github.com/BerMalBerIst/CVE-2022-22947"},{"source":"pocgithub","id":"Greetdawn/CVE-2022-22947","title":"Greetdawn/CVE-2022-22947","date":"2022-03-04","url":"https://github.com/Greetdawn/CVE-2022-22947"},{"source":"pocgithub","id":"Summer177/Spring-Cloud-Gateway-CVE-2022-22947","title":"Summer177/Spring-Cloud-Gateway-CVE-2022-22947","date":"2022-03-04","url":"https://github.com/Summer177/Spring-Cloud-Gateway-CVE-2022-22947"},{"source":"pocgithub","id":"dbgee/CVE-2022-22947","title":"dbgee/CVE-2022-22947","date":"2022-03-04","url":"https://github.com/dbgee/CVE-2022-22947"},{"source":"pocgithub","id":"dingxiao77/-cve-2022-22947-","title":"dingxiao77/-cve-2022-22947-","date":"2022-03-04","url":"https://github.com/dingxiao77/-cve-2022-22947-"},{"source":"pocgithub","id":"flying0er/CVE-2022-22947-goby","title":"flying0er/CVE-2022-22947-goby","date":"2022-03-04","url":"https://github.com/flying0er/CVE-2022-22947-goby"},{"source":"pocgithub","id":"hunzi0/CVE-2022-22947-Rce_POC","title":"hunzi0/CVE-2022-22947-Rce_POC","date":"2022-03-04","url":"https://github.com/hunzi0/CVE-2022-22947-Rce_POC"},{"source":"pocgithub","id":"nanaao/CVE-2022-22947-POC","title":"nanaao/CVE-2022-22947-POC","date":"2022-03-04","url":"https://github.com/nanaao/CVE-2022-22947-POC"},{"source":"pocgithub","id":"nu0l/cve-2022-22947","title":"nu0l/cve-2022-22947","date":"2022-03-04","url":"https://github.com/nu0l/cve-2022-22947"},{"source":"pocgithub","id":"tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway","title":"tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway","date":"2022-03-04","url":"https://github.com/tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway"},{"source":"pocgithub","id":"22ke/CVE-2022-22947","title":"22ke/CVE-2022-22947","date":"2022-03-05","url":"https://github.com/22ke/CVE-2022-22947"},{"source":"exploitdb","id":"EDB-50799","title":"Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)","type":"webapps","platform":"java","date":"2022-03-07","url":"https://www.exploit-db.com/exploits/50799"},{"source":"pocgithub","id":"Jun-5heng/CVE-2022-22947","title":"Jun-5heng/CVE-2022-22947","date":"2022-03-07","url":"https://github.com/Jun-5heng/CVE-2022-22947"},{"source":"pocgithub","id":"MoCh3n/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE","title":"MoCh3n/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE","date":"2022-03-07","url":"https://github.com/MoCh3n/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE"},{"source":"pocgithub","id":"YutuSec/SpEL","title":"YutuSec/SpEL","date":"2022-03-07","url":"https://github.com/YutuSec/SpEL"},{"source":"pocgithub","id":"darkb1rd/cve-2022-22947","title":"darkb1rd/cve-2022-22947","date":"2022-03-07","url":"https://github.com/darkb1rd/cve-2022-22947"},{"source":"pocgithub","id":"mrknow001/CVE-2022-22947","title":"mrknow001/CVE-2022-22947","date":"2022-03-07","url":"https://github.com/mrknow001/CVE-2022-22947"},{"source":"pocgithub","id":"0x7eTeam/CVE-2022-22947","title":"0x7eTeam/CVE-2022-22947","date":"2022-03-08","url":"https://github.com/0x7eTeam/CVE-2022-22947"},{"source":"pocgithub","id":"Arrnitage/CVE-2022-22947_exp","title":"Arrnitage/CVE-2022-22947_exp","date":"2022-03-10","url":"https://github.com/Arrnitage/CVE-2022-22947_exp"},{"source":"pocgithub","id":"PaoPaoLong-lab/Spring-CVE-2022-22947-","title":"PaoPaoLong-lab/Spring-CVE-2022-22947-","date":"2022-03-10","url":"https://github.com/PaoPaoLong-lab/Spring-CVE-2022-22947-"},{"source":"nuclei","id":"CVE-2022-22947","title":"Spring Cloud Gateway Code Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22947.yaml"}],"exploits_more":37,"fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway","fixed_in":["3.0.7","3.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}],"versions":["1.0.0.RELEASE","1.0.1.RELEASE","1.0.2.RELEASE","1.0.3.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.10.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.2.5.RELEASE","2.2.6.RELEASE","2.2.7.RELEASE","2.2.8.RELEASE","2.2.9.RELEASE","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.1"}]}],"versions":["3.1.0"]}],"products":[{"vendor":"oracle","product":"commerce_guided_search"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_cloud_native_core_console"},{"vendor":"oracle","product":"communications_cloud_native_core_network_exposure_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment"},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function"},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"},{"vendor":"vmware","product":"spring cloud gateway"},{"vendor":"vmware","product":"spring_cloud_gateway"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2022-22947","tags":["x_transferred","Mitigation","Vendor Advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22947","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22947","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3gx9-37ww-9qw6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22947.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-22947","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","status":"published","published":"2022-03-03T00:00:00Z","modified":"2025-10-21T23:15:45.22Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-1288","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","status":"published","published":"2022-03-03T00:00:00Z","modified":"2025-10-21T23:15:45Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-05-16","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-3gx9-37ww-9qw6","title":"Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured","description":"In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.","status":"published","published":"2022-03-04T00:00:15Z","modified":"2023-07-24T19:30:19Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-917"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"kev":[{"id":"CVE-2022-22947","title":"VMware Spring Cloud Gateway Code Injection Vulnerability","description":"Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.","cwes":["CWE-94"],"kev":{"date_added":"2022-05-16","due_date":"2022-06-06","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2022-22947","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","status":"published","published":"2022-03-03T22:15:08.673Z","modified":"2026-06-17T04:29:13.42Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94","CWE-917"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"CVE-2022-22947","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","status":"published","published":"2022-03-03T00:00:00Z","modified":"2026-10-28T02:30:34.549496745Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-3gx9-37ww-9qw6","title":"Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured","description":"In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.","status":"published","published":"2022-03-04T00:00:15Z","modified":"2024-02-16T08:19:02.311663Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917","CWE-94"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}