{"cve_id":"CVE-2022-22963","published":"2022-04-01T23:15:13.663000+00:00","last_modified":"2026-06-17T04:29:15.340000+00:00","vuln_status":"Analyzed","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":9.8,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-94","CWE-917"],"in_kev":true,"kev_date_added":"2022-08-25","kev_ransomware":false,"epss_score":0.99938,"epss_percentile":0.99971,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:59:04.100714+00:00","first_seen":"2022-04-01T23:15:13.663000+00:00","kev_first_seen":"2022-08-25T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["oracle","vmware"],"products":["banking_branch","banking_cash_management","banking_corporate_lending_process_management","banking_credit_facilities_process_management","banking_electronic_data_exchange_for_corporates","banking_liquidity_management","banking_origination","banking_supply_chain_finance","banking_trade_finance_process_management","banking_virtual_account_management","communications_cloud_native_core_automated_test_suite","communications_cloud_native_core_console","communications_cloud_native_core_network_exposure_function","communications_cloud_native_core_network_function_cloud_native_environment","communications_cloud_native_core_network_repository_function","communications_cloud_native_core_network_slice_selection_function","communications_cloud_native_core_policy","communications_cloud_native_core_security_edge_protection_proxy","communications_cloud_native_core_unified_data_repository","communications_communications_policy_management","financial_services_analytical_applications_infrastructure","financial_services_behavior_detection_platform","financial_services_enterprise_case_management","mysql_enterprise_monitor","product_lifecycle_analytics","retail_xstore_point_of_service","sd-wan_edge","spring_cloud_function"],"affected":[{"vendor":"oracle","product":"banking_branch","ranges":["14.5"]},{"vendor":"oracle","product":"banking_cash_management","ranges":["14.5"]},{"vendor":"oracle","product":"banking_corporate_lending_process_management","ranges":["14.5"]},{"vendor":"oracle","product":"banking_credit_facilities_process_management","ranges":["14.5"]},{"vendor":"oracle","product":"banking_electronic_data_exchange_for_corporates","ranges":["14.5"]},{"vendor":"oracle","product":"banking_liquidity_management","ranges":["14.5","14.2"]},{"vendor":"oracle","product":"banking_origination","ranges":["14.5"]},{"vendor":"oracle","product":"banking_supply_chain_finance","ranges":["14.5"]},{"vendor":"oracle","product":"banking_trade_finance_process_management","ranges":["14.5"]},{"vendor":"oracle","product":"banking_virtual_account_management","ranges":["14.5"]},{"vendor":"oracle","product":"communications_cloud_native_core_automated_test_suite","ranges":["22.1.0","1.9.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_console","ranges":["1.9.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_exposure_function","ranges":["22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment","ranges":["22.1.2","1.10.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function","ranges":["22.1.0","1.15.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function","ranges":["1.8.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_policy","ranges":["22.1.0","1.15.0","22.1.3"]},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy","ranges":["22.1.0","1.7.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_unified_data_repository","ranges":["1.15.0","22.1.0"]},{"vendor":"oracle","product":"communications_communications_policy_management","ranges":["12.6.0.0.0"]},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure","ranges":["8.1.2.0","8.1.1.0"]},{"vendor":"oracle","product":"financial_services_behavior_detection_platform","ranges":["8.1.1.0","8.1.2.0","8.1.1.1"]},{"vendor":"oracle","product":"financial_services_enterprise_case_management","ranges":["8.1.2.0","8.1.1.0","8.1.1.1"]},{"vendor":"oracle","product":"mysql_enterprise_monitor","ranges":["≤ 8.0.29"]},{"vendor":"oracle","product":"product_lifecycle_analytics","ranges":["3.6.1.0"]},{"vendor":"oracle","product":"retail_xstore_point_of_service","ranges":["21.0.0","20.0.1"]},{"vendor":"oracle","product":"sd-wan_edge","ranges":["9.0","9.1"]},{"vendor":"vmware","product":"spring_cloud_function","ranges":["≥ 3.2.0 and ≤ 3.2.2","≤ 3.1.6"]}]}