CVE-2022-22947 VMware Spring Cloud Gateway Code Injection

Exploited in the wild Critical 10.0 Published 3 Mar 2022 Updated 21 Oct 2025

Remote attackers can execute arbitrary code on hosts using Spring Cloud Gateway if the Actuator endpoint is enabled and unsecured.

Exploited in the wild: Since 16 May 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-22947?

CVE-2022-22947 is a critical code injection vulnerability in Oracle Commerce Guided Search, published on 3 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Weakness: CWE-917, CWE-94

Which versions are affected by CVE-2022-22947?

4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-gateway. It affects 10 products.

Package	Affected	Fixed in
`org.springframework.cloud:spring-cloud-gateway` Maven	All versions	`3.0.7`
`org.springframework.cloud:spring-cloud-gateway` Maven	All versions	`3.0.7`
`org.springframework.cloud:spring-cloud-gateway` Maven	From `3.1.0`	`3.1.1`
`org.springframework.cloud:spring-cloud-gateway` Maven	From `3.1.0`	`3.1.1`

Products include Oracle Commerce Guided Search, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Cloud Native Core Console, Oracle Communications Cloud Native Core Network Exposure Function, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Oracle Communications Cloud Native Core Network Repository Function and 4 more.

How do I fix CVE-2022-22947?

Upgrade org.springframework.cloud:spring-cloud-gateway to a fixed version for your release line: 3.0.7 or 3.1.1. US federal agencies must fix it by 6 Jun 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-22947 being exploited?

Yes. Attackers have exploited CVE-2022-22947 in the wild since at least 16 May 2022.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 62 proofs of concept on GitHub.

All Oracle Commerce Guided Search vulnerabilities

Sources

Also known as GHSA-3gx9-37ww-9qw6.