Threat operations/Case file
AL
Member accessPublic view · sign in

Vulnerability threat dossier

CVE-2022-22963

oraclebanking branch

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

VTP deterministic threat59.5of 100 · CVSS excluded

VTP analyst assessment

Spring Cloud Function remote code execution

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence90%
Public exploitation · VTP factKEV

Assessment

CISA KEV lists this Spring Cloud Function vulnerability as known to be exploited globally. Public exploit tooling is reported. The vulnerability affects routing functionality that accepts crafted expressions.

Why it matters

  • A remote attacker may execute code and access local resources through vulnerable routing functionality.
  • Public tooling can make testing vulnerable deployments easier.

Evidence

1 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The tooling evidence does not prove reliable exploitation.

We do not know whether affected Spring Cloud Function routing is used in this environment.

No VTP sensor telemetry is available.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

Review in your environment: if you use Spring Cloud Function routing, check affected versions and patch status.

AI baseline history (2)
  1. BASELINE ASSESSED
    Spring Cloud Function remote code executiongpt-5.6-terra · low
  2. BASELINE ASSESSED
    Spring Cloud Function routing-expression RCEgpt-5.6-sol · high
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityPOCReliability not implied
EPSS1.00100th percentile · prediction
Evidence confidence90%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    A proof of concept is reported; functional reliability is not established.

  3. 03

    EPSS is 1.00; this is predictive context, not exploitation evidence.

  4. 04

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

EXPLOIT TEMPLATE AVAILABLEPublic exploit-oriented template available
KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

1publications detected
1underlying evidence chains

0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOIT TEMPLATE AVAILABLEPUBLIC EXPLOIT TEMPLATE
90%claim confidence
PRIMARYcorpus:OPENVAS_NASL:9c2cc71f97f447ff3575921cbe1710003386df6cACTIVE
04

Event history

Threat timeline

  1. 02:3311 Sept
    EXPLOIT TEMPLATE AVAILABLE

    Public exploit-oriented template available

    Greenbone Community Feed published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.

  2. 00:0025 Aug
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

05

Original publications

Source record

Greenbone Community FeedEXPLOIT INTELLIGENCEPRIMARY

Exploit tooling coverage changed for 6 CVEs

Greenbone Community Feed recorded exploit-tooling coverage changes for 6 CVEs in this pinned revision. 6 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.

CVE-2021-36260CVE-2022-0543CVE-2022-21371CVE-2022-22947CVE-2022-22963CVE-2022-24716
Separate evidence group
06

Technical vulnerability data

Context, not threat proof

VTP threat score59.5vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction19.99 / 20
Exploit availability7.5 / 15
Source independence0 / 15
Intelligence recency2 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-917, CWE-94
CPE records
46
Deterministic history records
20
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.