In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
En Spring Cloud Function versiones 3.1.6, 3.2.2 y versiones anteriores no soportadas, cuando es usada la funcionalidad routing es posible que un usuario proporcione un SpEL especialmente diseñado como expresión de enrutamiento que puede resultar en la ejecución de código remota y el acceso a recursos locales
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-94
|
| [email protected] | Primary |
en
CWE-917
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| vmware | spring_cloud_function | * | <built-in method update of dict object at 0x77635f32d840> | Application |
| vmware | spring_cloud_function | * | <built-in method update of dict object at 0x77635fd88640> | Application |
| oracle | banking_branch | 14.5 | <built-in method update of dict object at 0x7763b9e85d80> | Application |
| oracle | banking_cash_management | 14.5 | <built-in method update of dict object at 0x7763bb739000> | Application |
| oracle | banking_corporate_lending_process_management | 14.5 | <built-in method update of dict object at 0x77635f32d780> | Application |
| oracle | banking_credit_facilities_process_management | 14.5 | <built-in method update of dict object at 0x7763d8b2c400> | Application |
| oracle | banking_electronic_data_exchange_for_corporates | 14.5 | <built-in method update of dict object at 0x7763d8971340> | Application |
| oracle | banking_liquidity_management | 14.2 | <built-in method update of dict object at 0x7763b9e85240> | Application |
| oracle | banking_liquidity_management | 14.5 | <built-in method update of dict object at 0x7763bbafdf00> | Application |
| oracle | banking_origination | 14.5 | <built-in method update of dict object at 0x7763a1fe8600> | Application |
| oracle | banking_supply_chain_finance | 14.5 | <built-in method update of dict object at 0x7763bbafe780> | Application |
| oracle | banking_trade_finance_process_management | 14.5 | <built-in method update of dict object at 0x77635fd89fc0> | Application |
| oracle | banking_virtual_account_management | 14.5 | <built-in method update of dict object at 0x7763d8d02f40> | Application |
| oracle | communications_cloud_native_core_automated_test_suite | 1.9.0 | <built-in method update of dict object at 0x7763d8d02f80> | Application |
| oracle | communications_cloud_native_core_automated_test_suite | 22.1.0 | <built-in method update of dict object at 0x7763d848d240> | Application |
| oracle | communications_cloud_native_core_console | 1.9.0 | <built-in method update of dict object at 0x7763a0678400> | Application |
| oracle | communications_cloud_native_core_console | 22.1.0 | <built-in method update of dict object at 0x7763a1160f40> | Application |
| oracle | communications_cloud_native_core_network_exposure_function | 22.1.0 | <built-in method update of dict object at 0x7763f05c6d40> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | <built-in method update of dict object at 0x7763a1125200> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 | <built-in method update of dict object at 0x7763a374d000> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.2 | <built-in method update of dict object at 0x7763a2f9d200> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.0 | <built-in method update of dict object at 0x7763bbbeec40> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.1.0 | <built-in method update of dict object at 0x7763d8b2ce80> | Application |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | <built-in method update of dict object at 0x7763a1fe9180> | Application |
| oracle | communications_cloud_native_core_network_slice_selection_function | 22.1.0 | <built-in method update of dict object at 0x7763a1feabc0> | Application |
| oracle | communications_cloud_native_core_policy | 1.15.0 | <built-in method update of dict object at 0x7763bbafc1c0> | Application |
| oracle | communications_cloud_native_core_policy | 22.1.0 | <built-in method update of dict object at 0x7763bbaff300> | Application |
| oracle | communications_cloud_native_core_policy | 22.1.3 | <built-in method update of dict object at 0x7763bbafc2c0> | Application |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | <built-in method update of dict object at 0x7763d8ecd9c0> | Application |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 22.1.0 | <built-in method update of dict object at 0x7763d8ece080> | Application |
| oracle | communications_cloud_native_core_unified_data_repository | 1.15.0 | <built-in method update of dict object at 0x7763d8eceb80> | Application |
| oracle | communications_cloud_native_core_unified_data_repository | 22.1.0 | <built-in method update of dict object at 0x7763d8ece380> | Application |
| oracle | communications_communications_policy_management | 12.6.0.0.0 | <built-in method update of dict object at 0x7763d8ecf3c0> | Application |
| oracle | financial_services_analytical_applications_infrastructure | 8.1.1.0 | <built-in method update of dict object at 0x7763d8ece540> | Application |
| oracle | financial_services_analytical_applications_infrastructure | 8.1.2.0 | <built-in method update of dict object at 0x7763d8ecc540> | Application |
| oracle | financial_services_behavior_detection_platform | 8.1.1.0 | <built-in method update of dict object at 0x7763d8ecdf00> | Application |
| oracle | financial_services_behavior_detection_platform | 8.1.1.1 | <built-in method update of dict object at 0x7763d8ecefc0> | Application |
| oracle | financial_services_behavior_detection_platform | 8.1.2.0 | <built-in method update of dict object at 0x7763d8ecfa00> | Application |
| oracle | financial_services_enterprise_case_management | 8.1.1.0 | <built-in method update of dict object at 0x7763d8ecf100> | Application |
| oracle | financial_services_enterprise_case_management | 8.1.1.1 | <built-in method update of dict object at 0x7763d8ecf880> | Application |
| oracle | financial_services_enterprise_case_management | 8.1.2.0 | <built-in method update of dict object at 0x7763d8ecf500> | Application |
| oracle | mysql_enterprise_monitor | * | <built-in method update of dict object at 0x7763d8ece0c0> | Application |
| oracle | product_lifecycle_analytics | 3.6.1.0 | <built-in method update of dict object at 0x7763d8ece700> | Application |
| oracle | retail_xstore_point_of_service | 20.0.1 | <built-in method update of dict object at 0x7763d8a04b80> | Application |
| oracle | retail_xstore_point_of_service | 21.0.0 | <built-in method update of dict object at 0x7763d8a078c0> | Application |
| oracle | sd-wan_edge | 9.0 | <built-in method update of dict object at 0x7763d8a069c0> | Application |
| oracle | sd-wan_edge | 9.1 | <built-in method update of dict object at 0x7763d8a058c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:banking_branch:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:* |