CISA KEV · Known exploitedCritical

CVE-2022-22963

VMware Tanzu Spring Cloud

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CVSS: 9.8
EPSS: 99.9%
CISA KEV: Listed
Published: 2022.04.02

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability99.9%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: VMware Tanzu Spring Cloud
Affected versions: Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions, <= 3.1.6, >= 3.2.0 <= 3.2.2, 14.5, 14.2, 1.9.0, 22.1.0, 1.10.0, 22.1.2, 1.15.0, 1.8.0, 22.1.3, 1.7.0, 12.6.0.0.0, 8.1.1.0, 8.1.2.0, 8.1.1.1, <= 8.0.29, 3.6.1.0, 20.0.1
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.09.15

1
Identify
Confirm that VMware Tanzu Spring Cloud and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-917, CWE-94
KEV added: 2022.08.25
Ransomware use: 미확인