{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aoraclecommunications_cloud_native_core_console22.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_cloud_gateway:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2022-22947"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Spring Cloud Gateway (\u003c 3.0.7, 3.1.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["VMware"],"content_html":"\u003cp\u003eCVE-2022-22947 is a remote code execution (RCE) vulnerability in Spring Cloud Gateway. The vulnerability allows unauthenticated attackers to inject malicious Spring Expression Language (SpEL) expressions via the Actuator endpoint when creating dynamic routes. When the application refreshes its configuration, the injected expression is evaluated, resulting in arbitrary code execution on the underlying server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an exposed and unprotected Actuator endpoint on the target Spring Cloud Gateway instance.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to \u003ccode\u003e/actuator/gateway/routes/{route_name}\u003c/code\u003e containing a JSON payload with a malicious SpEL expression in the filter arguments.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to \u003ccode\u003e/actuator/gateway/refresh\u003c/code\u003e to trigger the application to load the new route configuration.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP request matching the path defined in the newly created malicious route.\u003c/li\u003e\n\u003cli\u003eThe Gateway evaluates the injected SpEL expression during route processing.\u003c/li\u003e\n\u003cli\u003eArbitrary commands are executed by the application process with the privileges of the service user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability has a CVSS 3.1 score of 10.0 (Critical). Successful exploitation leads to full system compromise, allowing for remote code execution, unauthorized data access, and disruption of service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade VMware Spring Cloud Gateway to version 3.1.1 or 3.0.7 or later.\u003c/li\u003e\n\u003cli\u003eDisable the Actuator endpoint if it is not required for operational monitoring.\u003c/li\u003e\n\u003cli\u003eIf the Actuator endpoint is required, restrict network access using firewall rules or implement mandatory authentication via Spring Security to prevent unauthorized access.\u003c/li\u003e\n\u003cli\u003eAudit existing gateway route configurations for unexpected or malicious entries.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T09:40:03Z","date_published":"2026-10-30T09:40:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-spring-cloud-gateway-rce/","summary":"CVE-2022-22947 is a critical remote code execution vulnerability in Spring Cloud Gateway allowing attackers to execute arbitrary code via malicious SpEL expressions injected into dynamic route configurations.","title":"VMware Spring Cloud Gateway Remote Code Execution (CVE-2022-22947)","url":"https://feed.craftedsignal.io/briefs/2026-10-spring-cloud-gateway-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}