Code injection

2022-03-0416:15:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.

CPENameOperatorVersion
commerce_guided_searcheq11.3.2
communications_cloud_native_core_binding_support_functioneq22.1.3
communications_cloud_native_core_consoleeq22.2.0
communications_cloud_native_core_network_repository_functioneq22.2.0
communications_cloud_native_core_network_repository_functioneq22.1.2
communications_cloud_native_core_security_edge_protection_proxyeq22.1.1
spring_cloud_gatewayeq3.1.0

Name	Operator	Version
commerce_guided_search	eq	11.3.2
communications_cloud_native_core_binding_support_function	eq	22.1.3
communications_cloud_native_core_console	eq	22.2.0
communications_cloud_native_core_network_repository_function	eq	22.2.0
communications_cloud_native_core_network_repository_function	eq	22.1.2
communications_cloud_native_core_security_edge_protection_proxy	eq	22.1.1
spring_cloud_gateway	eq	3.1.0