Live › vulnerability › CVE-2022-22963
Go to dashboardSpring Cloud Function's routing feature evaluates a user-supplied SpEL routing expression, which lets a crafted expression run code on the server and reach local resources. An attacker who can send requests that set the routing expression gets remote code execution on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware Tanzu Spring Cloud | vendor | – | – |
| vmware spring cloud function | vendor | <= 3.1.6 | – |
| vmware spring cloud function | vendor | >= 3.2.0, <= 3.2.2 | – |
| oracle banking branch | vendor | = 14.5 | – |
| oracle banking cash management | vendor | = 14.5 | – |
| oracle banking corporate lending process management | vendor | = 14.5 | – |
| oracle banking credit facilities process management | vendor | = 14.5 | – |
| oracle banking electronic data exchange for corporates | vendor | = 14.5 | – |
| oracle banking liquidity management | vendor | = 14.2 | – |
| oracle banking liquidity management | vendor | = 14.5 | – |
| oracle banking origination | vendor | = 14.5 | – |
| oracle banking supply chain finance | vendor | = 14.5 | – |
| oracle banking trade finance process management | vendor | = 14.5 | – |
| oracle banking virtual account management | vendor | = 14.5 | – |
| oracle communications cloud native core automated test suite | vendor | = 1.9.0 | – |
| oracle communications cloud native core automated test suite | vendor | = 22.1.0 | – |
| oracle communications cloud native core console | vendor | = 1.9.0 | – |
| oracle communications cloud native core console | vendor | = 22.1.0 | – |
| oracle communications cloud native core network exposure function | vendor | = 22.1.0 | – |
| oracle communications cloud native core network function cloud native environment | vendor | = 1.10.0 | – |
| oracle communications cloud native core network function cloud native environment | vendor | = 22.1.0 | – |
| oracle communications cloud native core network function cloud native environment | vendor | = 22.1.2 | – |
| oracle communications cloud native core network repository function | vendor | = 1.15.0 | – |
| oracle communications cloud native core network repository function | vendor | = 22.1.0 | – |
| oracle communications cloud native core network slice selection function | vendor | = 1.8.0 | – |
| oracle communications cloud native core network slice selection function | vendor | = 22.1.0 | – |
| oracle communications cloud native core policy | vendor | = 1.15.0 | – |
| oracle communications cloud native core policy | vendor | = 22.1.0 | – |
| oracle communications cloud native core policy | vendor | = 22.1.3 | – |
| oracle communications cloud native core security edge protection proxy | vendor | = 1.7.0 | – |
| oracle communications cloud native core security edge protection proxy | vendor | = 22.1.0 | – |
| oracle communications cloud native core unified data repository | vendor | = 1.15.0 | – |
| oracle communications cloud native core unified data repository | vendor | = 22.1.0 | – |
| oracle communications communications policy management | vendor | = 12.6.0.0.0 | – |
| oracle financial services analytical applications infrastructure | vendor | = 8.1.1.0 | – |
| oracle financial services analytical applications infrastructure | vendor | = 8.1.2.0 | – |
| oracle financial services behavior detection platform | vendor | = 8.1.1.0 | – |
| oracle financial services behavior detection platform | vendor | = 8.1.1.1 | – |
| oracle financial services behavior detection platform | vendor | = 8.1.2.0 | – |
| oracle financial services enterprise case management | vendor | = 8.1.1.0 | – |
| oracle financial services enterprise case management | vendor | = 8.1.1.1 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2022-22963")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.