CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22979
https://notcve.org/view.php?id=CVE-2022-22979
21 Jun 2022 — In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework. Spring Cloud Function las versiones anteriores a 3.2.6, es posible que un usuario que interactúe directamente con la funcionalidad de búsqueda proporcionada por el framework cause una condición de denegación de servicio debido a un problema de almacena... • https://tanzu.vmware.com/security/cve-2022-22979 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.8EPSS: 94%CPEs: 47EXPL: 32CVE-2022-22963 – VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-22963
31 Mar 2022 — In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. En Spring Cloud Function versiones 3.1.6, 3.2.2 y versiones anteriores no soportadas, cuando es usada la funcionalidad routing es posible que un usuario proporcione un SpEL especialmente diseñado como expresión de enrutamiento que puede resul... • https://packetstorm.news/files/id/173430 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •