Vulnerability · Published Jun 21, 2022 · Assigned by vmware
CVE-2022-22979
High 7.5
In plain English
A high-severity security flaw in Spring Cloud Function. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.4%top 27.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-function-parent | 3.2.6 | GHSA-q588-3544-8g33 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Cloud Function | Spring Cloud Function (prior to 3.2.6) |
References
- https://tanzu.vmware.com/security/cve-2022-22979 x_refsource_MISC