{"id":"CVE-2022-22963","kind":"vulnerability","aliases":["CVE-2022-22963"],"related":[],"title":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it…","description":"When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Spring Cloud Function's routing feature evaluates a user-supplied SpEL routing expression, which lets a crafted expression run code on the server and reach local resources. An attacker who can send requests that set the routing expression gets remote code execution on the host.","severity":"critical","cvss":9.8,"epss":0.99938,"exploited":true,"exploited_at":"2022-08-25T00:00:00+00:00","products":[{"name":"VMware Tanzu Spring Cloud","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vmware spring cloud function","fixed":[],"affected":"<= 3.1.6","ecosystem":"vendor"},{"name":"vmware spring cloud function","fixed":[],"affected":">= 3.2.0, <= 3.2.2","ecosystem":"vendor"},{"name":"oracle banking branch","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking cash management","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking corporate lending process management","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking credit facilities process management","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking electronic data exchange for corporates","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking liquidity management","fixed":[],"affected":"= 14.2","ecosystem":"vendor"},{"name":"oracle banking liquidity management","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking origination","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking supply chain finance","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking trade finance process management","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle banking virtual account management","fixed":[],"affected":"= 14.5","ecosystem":"vendor"},{"name":"oracle communications cloud native core automated test suite","fixed":[],"affected":"= 1.9.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core automated test suite","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core console","fixed":[],"affected":"= 1.9.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core console","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network exposure function","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network function cloud native environment","fixed":[],"affected":"= 1.10.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network function cloud native environment","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network function cloud native environment","fixed":[],"affected":"= 22.1.2","ecosystem":"vendor"},{"name":"oracle communications cloud native core network repository function","fixed":[],"affected":"= 1.15.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network repository function","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network slice selection function","fixed":[],"affected":"= 1.8.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core network slice selection function","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core policy","fixed":[],"affected":"= 1.15.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core policy","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core policy","fixed":[],"affected":"= 22.1.3","ecosystem":"vendor"},{"name":"oracle communications cloud native core security edge protection proxy","fixed":[],"affected":"= 1.7.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core security edge protection proxy","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core unified data repository","fixed":[],"affected":"= 1.15.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core unified data repository","fixed":[],"affected":"= 22.1.0","ecosystem":"vendor"},{"name":"oracle communications communications policy management","fixed":[],"affected":"= 12.6.0.0.0","ecosystem":"vendor"},{"name":"oracle financial services analytical applications infrastructure","fixed":[],"affected":"= 8.1.1.0","ecosystem":"vendor"},{"name":"oracle financial services analytical applications infrastructure","fixed":[],"affected":"= 8.1.2.0","ecosystem":"vendor"},{"name":"oracle financial services behavior detection platform","fixed":[],"affected":"= 8.1.1.0","ecosystem":"vendor"},{"name":"oracle financial services behavior detection platform","fixed":[],"affected":"= 8.1.1.1","ecosystem":"vendor"},{"name":"oracle financial services behavior detection platform","fixed":[],"affected":"= 8.1.2.0","ecosystem":"vendor"},{"name":"oracle financial services enterprise case management","fixed":[],"affected":"= 8.1.1.0","ecosystem":"vendor"},{"name":"oracle financial services enterprise case management","fixed":[],"affected":"= 8.1.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","kubernetes","package","spring","spring-cloud-function"],"not_affected_if":["patched-version","routing-feature-unused"],"how_to_check":null,"fix":"Upgrade VMware Tanzu Spring Cloud Function to a patched version per vendor instructions; the sources do not name the fixed version.\nCISA KEV lists this as actively exploited, so treat any unpatched instance as compromised until checked.","status":"open","published_at":"2022-04-01T23:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:53+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:10:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade VMware Tanzu Spring Cloud Function to a patched version per vendor instructions; the sources do not name the fixed version.\nCISA KEV lists this as actively exploited, so treat any unpatched instance as compromised until checked.","reach":"internet","impact":"high","summary":"Spring Cloud Function's routing feature evaluates a user-supplied SpEL routing expression, which lets a crafted expression run code on the server and reach local resources. An attacker who can send requests that set the routing expression gets remote code execution on the host.","category":"package","who_cares":["spring-cloud-function","java","spring","kubernetes"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the server and reads local resources.","analyst_note":"Find the fixed version and the vulnerable-version range in the VMware Tanzu advisory for CVE-2022-22963 and confirm how to detect use of the routing feature.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["routing-feature-unused","patched-version"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000492,"input_tokens":2871,"output_tokens":410,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':17A,20A '-22963':18A,21A '3.1.6':6A '3.2.2':7A 'access':377C 'account':85A 'action':383C 'analytical':247A,253A 'appli':384C 'applications':248A,254A 'attack':324B 'automated':92A,100A 'banking':35A,38A,42A,48A,54A,61A,65A,69A,72A,77A,83A 'behavior':259A,265A,271A 'branch':36A 'case':278A,284A 'cash':39A 'chain':74A 'cisa':381C 'cloud':3A,25A,28A,32A,89A,97A,105A,111A,117A,125A,130A,135A,140A,145A,150A,155A,163A,171A,180A,189A,195A,201A,207A,216A,225A,233A,293B,296B,350C 'code':315B,336B,374C 'communications':88A,96A,104A,110A,116A,124A,134A,144A,154A,162A,170A,179A,188A,194A,200A,206A,215A,224A,232A,240A,241A 'console':108A,114A 'core':91A,99A,107A,113A,119A,127A,137A,147A,157A,165A,173A,182A,191A,197A,203A,209A,218A,227A,235A 'corporate':43A 'corporates':59A 'craft':312B,362C 'credit':49A 'cve':16A,19A 'data':56A,229A,237A 'detection':260A,266A,272A 'edge':211A,220A 'electronic':55A 'enterprise':277A,283A 'environment':132A,142A,152A 'evalu':301B 'exchange':57A 'execut':337B,375C 'exploit':286B 'exposure':121A 'express':308B,313B,333B,368C 'facilities':50A 'featur':300B 'finance':75A,79A 'financial':245A,251A,257A,263A,269A,275A,281A 'for':58A 'function':4A,15A,29A,33A,122A,129A,139A,149A,160A,168A,177A,186A,294B,297B,344C,351C 'get':334B 'host':340B 'infrastructure':249A,255A 'instruct':388C 'java':287B 'kubernet':288B 'lending':44A 'let':310B 'liquidity':62A,66A 'local':321B,379C 'management':40A,46A,52A,63A,67A,81A,86A,243A,279A,285A 'may':370C 'native':90A,98A,106A,112A,118A,126A,131A,136A,141A,146A,151A,156A,164A,172A,181A,190A,196A,202A,208A,217A,226A,234A 'network':120A,128A,138A,148A,158A,166A,174A,183A 'older':9A 'oracle':34A,37A,41A,47A,53A,60A,64A,68A,71A,76A,82A,87A,95A,103A,109A,115A,123A,133A,143A,153A,161A,169A,178A,187A,193A,199A,205A,214A,223A,231A,239A,244A,250A,256A,262A,268A,274A,280A 'origination':70A 'packag':289B 'per':386C 'platform':261A,267A,273A 'policy':192A,198A,204A,242A 'possibl':354C 'process':45A,51A,80A 'protection':212A,221A 'provid':359C 'proxy':213A,222A 'reach':320B 'remot':335B,373C 'repository':159A,167A,230A,238A 'request':328B 'requir':382C 'resourc':322B,380C 'result':371C 'rout':14A,299B,307B,332B,343C,367C 'routing-express':366C 'run':314B 'security':210A,219A 'selection':176A,185A 'send':327B 'server':318B 'services':246A,252A,258A,264A,270A,276A,282A 'set':330B 'slice':175A,184A 'special':361C 'spel':306B,363C 'spring':2A,24A,27A,31A,290B,292B,295B,349C 'spring-cloud-funct':291B 'suite':94A,102A 'suppli':305B 'supply':73A 'tanzu':23A,347C 'test':93A,101A 'trade':78A 'unified':228A,236A 'unsupport':10A 'updat':385C 'use':13A,342C 'user':304B,357C 'user-suppli':303B 'vendor':387C 'version':5A,11A 'virtual':84A 'vmware':22A,26A,30A,346C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-04-01T23:15:13+00:00","kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22963","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22963","severity":null,"published_at":"2022-08-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"epss","external_id":"CVE-2022-22963","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22963","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22963","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22963","severity":null,"published_at":"2022-04-01T23:15:13+00:00","modified_at":"2026-06-17T04:29:15+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}