Exploited Vulnerabilities DailyCVE-2022-22963: VMware Tanzu Spring Cloud
EPSS99.9%No. 105 of 1739 in KEV
CVE year2022listed the same year
Same vendor in KEV3
Same product1
| Field | Value |
|---|---|
| Vendor | VMware Tanzu |
| Product | Spring Cloud |
| Name | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability |
| Added to KEV | 2022-08-25 |
| US federal due date | 2022-09-15 |
| Ransomware use | Unknown |
| CWE | CWE-94 |
CISA description
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A VMware Tanzu Spring Cloud vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-25.