{"cve_id":"CVE-2022-22947","published":"2022-03-03T22:15:08.673000+00:00","last_modified":"2026-06-17T04:29:13.420000+00:00","vuln_status":"Analyzed","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","base_score":10.0,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"CHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-94","CWE-917"],"in_kev":true,"kev_date_added":"2022-05-16","kev_ransomware":false,"epss_score":0.98253,"epss_percentile":0.99916,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"PRIV","caps":["CODE_EXEC","PRIV_GAIN"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:58:03.213868+00:00","first_seen":"2022-03-03T22:15:08.673000+00:00","kev_first_seen":"2022-05-16T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["oracle","vmware"],"products":["commerce_guided_search","communications_cloud_native_core_binding_support_function","communications_cloud_native_core_console","communications_cloud_native_core_network_exposure_function","communications_cloud_native_core_network_function_cloud_native_environment","communications_cloud_native_core_network_repository_function","communications_cloud_native_core_network_slice_selection_function","communications_cloud_native_core_security_edge_protection_proxy","communications_cloud_native_core_service_communication_proxy","spring_cloud_gateway"],"affected":[{"vendor":"oracle","product":"commerce_guided_search","ranges":["11.3.2"]},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function","ranges":["1.11.0","22.1.3"]},{"vendor":"oracle","product":"communications_cloud_native_core_console","ranges":["22.2.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_exposure_function","ranges":["22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment","ranges":["1.10.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function","ranges":["1.15.1","22.2.0","1.15.0","22.1.2"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function","ranges":["1.8.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy","ranges":["22.1.1"]},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy","ranges":["1.15.0"]},{"vendor":"vmware","product":"spring_cloud_gateway","ranges":["3.1.0","< 3.0.7"]}]}