<p>Upgrade <code>org.springframework.cloud:spring-cloud-function-context</code> to version 3.1.7, 3.2.3 or higher.</p>

Remote Code Execution Affecting org.springframework.cloud:spring-cloud-function-context package, versions [,3.1.7) [3.2.0,3.2.3)

Snyk CVSS

Attack Complexity Low

Confidentiality High

Integrity High

Availability High

Threat Intelligence

Exploit Maturity Mature

EPSS 97.54% (100^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKCLOUD-2436645
published 30 Mar 2022
disclosed 30 Mar 2022
credit m09u3r

Report a new vulnerability Found a mistake?

Introduced: 30 Mar 2022

CVE-2022-22963 Open this link in a new tab CWE-497 Open this link in a new tab CWE-770 Open this link in a new tab CWE-94 Open this link in a new tab

How to fix?

Upgrade org.springframework.cloud:spring-cloud-function-context to version 3.1.7, 3.2.3 or higher.

Overview

Affected versions of this package are vulnerable to Remote Code Execution. An attacker is able to provide a crafted SpEL as a routing-expression that may result in access to local resources or even remote code execution.