CVE-2022-22947

01/תיאור (מקור, אנגלית)

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

02/מוצרים מושפעים

vmware: spring cloud gateway; oracle: commerce guided search; oracle: communications cloud native core binding support function; oracle: communications cloud native core console; oracle: communications cloud native core network exposure function; oracle: communications cloud native core network function cloud native environment; oracle: communications cloud native core network repository function; oracle: communications cloud native core network slice selection function; oracle: communications cloud native core security edge protection proxy; oracle: communications cloud native core service communication proxy

03/קישורים10

• tanzu.vmware.com/security/cve-2022-22947 MitigationVendor Advisory
• tanzu.vmware.com/security/cve-2022-22947 MitigationVendor Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
• packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.‮… ExploitThird Party AdvisoryVDB Entry