Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability

blog.viettelcybersecurity.com | vulnerability | CVE-2022-22947 | #cloud | #rce | #zero-day | #java | #vulnerability | #cve-2022-22947 | #spring-cloud-gateway | #el-injection

Summary

Viettel researchers analyze CVE-2022-22947, a Spring Cloud Gateway 0-day where exposed actuator endpoints permit adding SpEL-filter routes, leading to RCE via EL injection.
Published
Collected

original ↗

Related coverage

  1. Critical remote code execution in vm2, a widely used Node.js sandbox library (about.gitlab.com)
  2. Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise (wiz.io)
  3. ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch (github.com)
  4. StyleSmuggler fix: patch the Magento and Adobe Commerce RCE (aikido.dev)
  5. From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuse (lab.ctbb.show)
  6. Crying out Cloud – Our Favorite Stories of 2023 (wiz.io)

back