{"id":"CVE-2022-22947","kind":"vulnerability","aliases":["CVE-2022-22947"],"related":[],"title":"VMware Spring Cloud Gateway: VMware Spring Cloud Gateway Code Injection Vulnerability","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","summary":"Spring Cloud Gateway applications are vulnerable to code injection when the Gateway Actuator endpoint is enabled, exposed and unsecured. An unauthenticated attacker who can reach that endpoint can inject code and run it on the server.","severity":"critical","cvss":10.0,"epss":0.98253,"exploited":true,"exploited_at":"2022-05-16T00:00:00+00:00","products":[{"name":"VMware Spring Cloud Gateway","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","runtime","self-hosted","spring-boot","spring-cloud-gateway"],"not_affected_if":["auth-required","default-config"],"how_to_check":"Check whether management.endpoint.gateway.enabled is true or the gateway actuator is exposed via management.endpoints.web.exposure.include in application config.\nCheck whether Spring Security protects the /actuator/gateway paths.","fix":"Upgrade Spring Cloud Gateway to a fixed release per the VMware advisory; the fixed versions are not stated in the sources.\nIf upgrading is not possible, disable the gateway actuator endpoint or require authentication on it.","status":"open","published_at":"2022-03-03T22:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:17:37Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Spring Cloud Gateway to a fixed release per the VMware advisory; the fixed versions are not stated in the sources.\nIf upgrading is not possible, disable the gateway actuator endpoint or require authentication on it.","reach":"network","impact":"high","summary":"Spring Cloud Gateway applications are vulnerable to code injection when the Gateway Actuator endpoint is enabled, exposed and unsecured. An unauthenticated attacker who can reach that endpoint can inject code and run it on the server.","category":"runtime","who_cares":["spring-cloud-gateway","java","spring-boot","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker injects code and runs commands on the gateway server.","analyst_note":"Find the affected and fixed version ranges in the VMware advisory for CVE-2022-22947, since the sources left them unknown.","how_to_check":"Check whether management.endpoint.gateway.enabled is true or the gateway actuator is exposed via management.endpoints.web.exposure.include in application config.\nCheck whether Spring Security protects the /actuator/gateway paths.\nunknown","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000522,"input_tokens":2847,"output_tokens":474,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':13A,16A '-22947':14A,17A '3.0.7':80C '3.1.1':78C 'actuat':47B,92C 'allow':110C 'applic':38B,81C 'arbitrari':111C 'attack':56B,88C,101C 'boot':30B 'cloud':3A,7A,20A,33B,36B,73C 'code':9A,42B,64B,86C 'could':102C,109C 'craft':106C 'cve':12A,15A 'enabl':50B,95C 'endpoint':48B,61B,93C 'execut':113C 'exploit':22B 'expos':51B,96C 'gateway':4A,8A,21A,34B,37B,46B,74C,91C 'host':27B,117C 'inject':10A,43B,63B,87C 'java':23B 'make':103C 'malici':105C 'prior':76C 'reach':59B 'remot':100C,112C,116C 'request':107C 'run':66B 'runtim':24B 'self':26B 'self-host':25B 'server':70B 'spring':2A,6A,19A,29B,32B,35B,72C 'spring-boot':28B 'spring-cloud-gateway':31B 'unauthent':55B 'unsecur':53B,98C 'version':75C 'vmware':1A,5A,18A 'vulner':11A,40B,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-03T22:15:08+00:00","kev":{"dateAdded":"2022-05-16","dueDate":"2022-06-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22947","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22947","severity":null,"published_at":"2022-05-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:42+00:00","note":null},{"source":"epss","external_id":"CVE-2022-22947","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22947","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22947","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22947","severity":null,"published_at":"2022-03-03T22:15:08+00:00","modified_at":"2026-06-17T04:29:13+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}