CVE-2022-22963

01/תיאור (מקור, אנגלית)

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

02/מוצרים מושפעים

vmware: spring cloud function; oracle: banking branch; oracle: banking cash management; oracle: banking corporate lending process management; oracle: banking credit facilities process management; oracle: banking electronic data exchange for corporates; oracle: banking liquidity management; oracle: banking origination; oracle: banking supply chain finance; oracle: banking trade finance process management; oracle: banking virtual account management; oracle: communications cloud native core automated test suite; oracle: communications cloud native core console; oracle: communications cloud native core network exposure function; oracle: communications cloud native core network function cloud native environment

03/קישורים10

• tanzu.vmware.com/security/cve-2022-22963 Vendor Advisory
• tanzu.vmware.com/security/cve-2022-22963 Vendor Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
• packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote‮… ExploitThird Party AdvisoryVDB Entry
• psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 Third Party Advisory
• tools.cisco.com/security/center/content/CiscoSecurityAdvisory/‮… Third Party Advisory