Read the docs
TI-2022-07140 Aliases CVE-2022-22963GHSA-6v73-fgf6-w5j7

Code injection in Spring Cloud Function

Priority CRITICAL 100Exploited in the wildCWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Why it matters now

Exploitation Active In CISA KEV since 2022-08-25CISA due date 2022-09-15
EPSS 0.99938 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.springframework.cloud:spring-cloud-function-context (Maven): 3.2.3, 3.1.7Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring Cloud FunctionSpring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions—No fix listedCNA
—org.springframework.cloud:spring-cloud-function-context (Maven)3.2.0 to before 3.2.33.2.3Patch availableGHSA-6v73-fgf6-w5j7
—org.springframework.cloud:spring-cloud-function-context (Maven)before 3.1.73.1.7Patch availableGHSA-6v73-fgf6-w5j7
  • Spring Cloud Function Vendor— Affected Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions Fixed in — No fix listed CNA
  • org.springframework.cloud:spring-cloud-function-context (Maven) Vendor— Affected 3.2.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-6v73-fgf6-w5j7
  • org.springframework.cloud:spring-cloud-function-context (Maven) Vendor— Affected before 3.1.7 Fixed in 3.1.7 Patch available GHSA-6v73-fgf6-w5j7

CPE configurations NVD · 46

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*up to 3.1.6; 3.2.0 – 3.2.2VulnerableVMware
cpe:2.3:a:oracle:banking_branch:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*14.2VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
  • cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* Versions up to 3.1.6; 3.2.0 – 3.2.2 Vulnerable ·VMware
  • cpe:2.3:a:oracle:banking_branch:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
Show 36 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*14.5VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.2:*:*:*:*:*:*:*22.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*22.1.3VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*12.6.0.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*8.1.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*8.1.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.29VulnerableOracle
cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1.0:*:*:*:*:*:*:*3.6.1.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.2:*:*:*:*:*:*:* Versions 22.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:* Versions 12.6.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:* Versions 8.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:* Versions 8.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1.0:*:*:*:*:*:*:* Versions 3.6.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-6v73-fgf6-w5j7 org.springframework.cloud:spring-cloud-function-context (Maven) Fixed in 3.2.3 Advisory →
  • Fix · GHSA-6v73-fgf6-w5j7 org.springframework.cloud:spring-cloud-function-context (Maven) Fixed in 3.1.7 Advisory →

Red Hat 2 advisories

  • RHSA-2022:1292 Released 2022-04-11 · Red Hat rating Low
    Release of OpenShift Serverless 1.21.1
    • Red Hat OpenShift Serverless 1.21 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/kn-cli-artifacts-rhel8
  • RHSA-2022:1291 Released 2022-04-11 · Red Hat rating Low
    Release of OpenShift Serverless Client kn 1.21.1
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.0.1-2.el8

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:1291
Red Hat OpenShift Serverless 1.21Fixed RHSA-2022:1292
Not affected: 2 products
  • OpenShift Serverless
  • Red Hat OpenShift Serverless 1.21

Timeline

  1. 2022-08-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-22963
  3. 2026-10-03 Alias added: GHSA-6v73-fgf6-w5j7

References

Exploit 1

Patch 2

Advisory 4

Other 2

  • TI-2022-07155 Resource allocation without limits in Spring Cloud Function CVSS 3.1HIGH 7.5
  • TI-2026-29641 Unbounded cache for function definitions CVSS 3.1MEDIUM 6.5
  • TI-2026-29640 Self Routing guard bypassed via function composition CVSS 3.1MEDIUM 6.5
  • TI-2026-42423 Server-side request forgery in VMware Spring Cloud Function CVSS 3.1MEDIUM 5.5
  • TI-2026-42434 Sensitive information in log files in VMware Spring Cloud Stream CVSS 3.1MEDIUM 4.9
  • TI-2026-42433 Sensitive information in log files in VMware Spring Cloud Function CVSS 3.1MEDIUM 4.9
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences