Live › vulnerability › CVE-2022-22947
Go to dashboardSpring Cloud Gateway applications are vulnerable to code injection when the Gateway Actuator endpoint is enabled, exposed and unsecured. An unauthenticated attacker who can reach that endpoint can inject code and run it on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware Spring Cloud Gateway | vendor | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
This page as .md · .json · in your agent: get_signal("CVE-2022-22947")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.