{"answers":{"affected":"4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-function-context. It affects 28 products.","exploited":"Yes. Attackers have exploited CVE-2022-22963 in the wild since at least 25 Aug 2022.","fix":"Upgrade org.springframework.cloud:spring-cloud-function-context to a fixed version for your release line: 3.1.7 or 3.2.3. US federal agencies must fix it by 15 Sep 2022.","what":"CVE-2022-22963 is a critical code injection vulnerability in Oracle Communications Cloud Native Core Automated Test Suite, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-22963 and fix it if it is affected.\n\nWhat it is: CVE-2022-22963 is a critical code injection vulnerability in Oracle Communications Cloud Native Core Automated Test Suite, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2022-22963 in the wild since at least 25 Aug 2022.\n\nAffected packages and fixed versions:\n- org.springframework.cloud:spring-cloud-function-context (Maven): affected all versions; fixed in 3.1.7\n- org.springframework.cloud:spring-cloud-function-context (Maven): affected all versions; fixed in 3.1.7\n- org.springframework.cloud:spring-cloud-function-context (Maven): affected from 3.2.0; fixed in 3.2.3\n- org.springframework.cloud:spring-cloud-function-context (Maven): affected from 3.2.0; fixed in 3.2.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-22963/ (Markdown: https://insights.sbomify.com/CVE-2022-22963/index.md)","id":"CVE-2022-22963","markdown":"https://insights.sbomify.com/CVE-2022-22963/index.md","name":"CVE-2022-22963","record":{"aliases":["GHSA-6v73-fgf6-w5j7","RHSA-2022:1291"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Spring Cloud Function","requires_auth":"none","summary":"Attackers can achieve remote code execution by injecting malicious SpEL expressions into routing functionality in Spring Cloud Function.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"vmware","cpe":[{"product":"banking_branch","vendor":"oracle"},{"product":"banking_cash_management","vendor":"oracle"},{"product":"banking_corporate_lending_process_management","vendor":"oracle"},{"product":"banking_credit_facilities_process_management","vendor":"oracle"},{"product":"banking_electronic_data_exchange_for_corporates","vendor":"oracle"},{"product":"banking_liquidity_management","vendor":"oracle"},{"product":"banking_origination","vendor":"oracle"},{"product":"banking_supply_chain_finance","vendor":"oracle"},{"product":"banking_trade_finance_process_management","vendor":"oracle"},{"product":"banking_virtual_account_management","vendor":"oracle"},{"product":"communications_cloud_native_core_automated_test_suite","vendor":"oracle"},{"product":"communications_cloud_native_core_console","vendor":"oracle"},{"product":"communications_cloud_native_core_network_exposure_function","vendor":"oracle"},{"product":"communications_cloud_native_core_network_function_cloud_native_environment","vendor":"oracle"},{"product":"communications_cloud_native_core_network_repository_function","vendor":"oracle"},{"product":"communications_cloud_native_core_network_slice_selection_function","vendor":"oracle"},{"product":"communications_cloud_native_core_policy","vendor":"oracle"},{"product":"communications_cloud_native_core_security_edge_protection_proxy","vendor":"oracle"},{"product":"communications_cloud_native_core_unified_data_repository","vendor":"oracle"},{"product":"communications_communications_policy_management","vendor":"oracle"},{"product":"financial_services_analytical_applications_infrastructure","vendor":"oracle"},{"product":"financial_services_behavior_detection_platform","vendor":"oracle"},{"product":"financial_services_enterprise_case_management","vendor":"oracle"},{"product":"mysql_enterprise_monitor","vendor":"oracle"},{"product":"product_lifecycle_analytics","vendor":"oracle"},{"product":"retail_xstore_point_of_service","vendor":"oracle"},{"product":"sd-wan_edge","vendor":"oracle"},{"product":"spring_cloud_function","vendor":"vmware"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","ecosystems":["Maven","Red Hat:serverless:1.0::el8"],"exploits":{"exploitdb":1,"first_seen":"2022-03-26","github_poc":30,"max_poc_stars":354,"metasploit":1,"nuclei":1,"refs":[{"date":"2022-03-26T01:40:04Z","kind":"github_poc","ref":"https://github.com/hktalent/spring-spel-0day-poc","stars":354,"title":"spring-cloud / spring-cloud-function,spring.cloud.function.routing-expression,RCE,0day,0-day,POC,EXP,CVE-2022-22963"},{"date":"2022-03-30T05:04:24Z","kind":"github_poc","ref":"https://github.com/dinosn/CVE-2022-22963","stars":118,"title":"CVE-2022-22963 PoC "},{"date":"2022-03-30T15:49:32Z","kind":"github_poc","ref":"https://github.com/darryk10/CVE-2022-22963","stars":34,"title":null},{"date":"2023-03-18T11:43:00Z","kind":"github_poc","ref":"https://github.com/J0ey17/CVE-2022-22963_Reverse-Shell-Exploit","stars":24,"title":"CVE-2022-22963 is a vulnerability in the Spring Cloud Function Framework for Java that allows remote code execution. This python script will verify if the vulnerability exists, and if it does, will give you a reverse shell."},{"date":"2022-03-31T14:32:14Z","kind":"github_poc","ref":"https://github.com/me2nuk/CVE-2022-22963","stars":19,"title":"Spring Cloud Function Vulnerable Application / CVE-2022-22963"},{"date":"2022-03-30T11:36:42Z","kind":"github_poc","ref":"https://github.com/RanDengShiFu/CVE-2022-22963","stars":15,"title":"CVE-2022-22963 Spring-Cloud-Function-SpEL_RCE_exploit"},{"date":"2022-03-31T20:19:51Z","kind":"github_poc","ref":"https://github.com/kh4sh3i/Spring-CVE","stars":14,"title":"This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed \"SpringShell\"."},{"date":"2022-03-30T17:37:35Z","kind":"github_poc","ref":"https://github.com/Kirill89/CVE-2022-22963-PoC","stars":9,"title":null}],"tier":"exploited"},"has_fix":true,"headline":"VMware Tanzu Spring Cloud Function Remote Code Execution","id":"CVE-2022-22963","indexable":true,"kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","knownRansomwareCampaignUse":"Unknown","product":"Spring Cloud","requiredAction":"Apply updates per vendor instructions.","vendorProject":"VMware Tanzu","vulnerabilityName":"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability"},"kind":"cve","links":{"ecosystem":"Maven","product":"oracle:communications_cloud_native_core_automated_test_suite","products":["oracle:communications_cloud_native_core_automated_test_suite","oracle:communications_cloud_native_core_policy","oracle:financial_services_analytical_applications_infrastructure","oracle:mysql_enterprise_monitor","oracle:retail_xstore_point_of_service"],"type":"code_injection","year":"2022"},"n_packages":5,"n_references":6,"next":{"headline":"Privilege escalation in VMware Horizon Agent for Linux","id":"CVE-2022-22964"},"packages":[{"ecosystem":"Maven","fixed":["3.1.7"],"introduced":["0"],"last_affected":[],"package":"org.springframework.cloud:spring-cloud-function-context","purl":null,"source":"GHSA-6v73-fgf6-w5j7"},{"ecosystem":"Maven","fixed":["3.1.7"],"introduced":["0"],"last_affected":[],"package":"org.springframework.cloud:spring-cloud-function-context","purl":"pkg:maven/org.springframework.cloud/spring-cloud-function-context","source":"GHSA-6v73-fgf6-w5j7"},{"ecosystem":"Maven","fixed":["3.2.3"],"introduced":["3.2.0"],"last_affected":[],"package":"org.springframework.cloud:spring-cloud-function-context","purl":null,"source":"GHSA-6v73-fgf6-w5j7"},{"ecosystem":"Maven","fixed":["3.2.3"],"introduced":["3.2.0"],"last_affected":[],"package":"org.springframework.cloud:spring-cloud-function-context","purl":"pkg:maven/org.springframework.cloud/spring-cloud-function-context","source":"GHSA-6v73-fgf6-w5j7"},{"ecosystem":"Red Hat:serverless:1.0::el8","fixed":["0:1.0.1-2.el8"],"introduced":["0"],"last_affected":[],"package":"openshift-serverless-clients","purl":"pkg:rpm/redhat/openshift-serverless-clients","source":"RHSA-2022:1291"}],"prev":{"headline":"Path traversal in VMware Horizon Agent for Linux","id":"CVE-2022-22962"},"products":["Spring Cloud Function"],"published":"2022-04-01","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-21","vendors":["n/a"]},"summary":"Attackers can achieve remote code execution by injecting malicious SpEL expressions into routing functionality in Spring Cloud Function.","url":"https://insights.sbomify.com/CVE-2022-22963/"}