---
id: 7364
title: "CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability"
cve: CVE-2022-22947
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/cve-2022-22947-spring-cloud-gateway-code-injection-vulnerability/"
published_at: "2022-03-23T07:17:30Z"
tags: ["cloud", "rce", "zero-day", "java", "vulnerability", "cve-2022-22947", "spring-cloud-gateway", "el-injection"]
phying_url: "https://phying.com/item/7364"
lang: en
---

# CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability

## Summary

Viettel researchers analyze CVE-2022-22947, a Spring Cloud Gateway 0-day where exposed actuator endpoints permit adding SpEL-filter routes, leading to RCE via EL injection.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2022-22947
- **Published:** 2022-03-23T07:17:30Z
- **Original:** https://blog.viettelcybersecurity.com/cve-2022-22947-spring-cloud-gateway-code-injection-vulnerability/
- **Phying News:** https://phying.com/item/7364