Spring-Cloud-Gateway-CVE-2022-22947

Spring-Cloud-Gateway-CVE-2022-22947 Уведомление об уязвимости удаленного выполнения кода в Spring Cloud Gateway. Эта уязвимость позволяет выполнить инъекцию кода в приложения, использующие Spring Cloud Gateway, если включена и доступна конечная точка Gateway Actuator. Злоумышленник может отправит...

CVE-2022-22947_EXP

1. Удаленное выполнение кода в Spring Cloud Gateway Уровень опасности: Высокий Статус POC/EXP: Опубликован Номер CNVD: CNNVD-2022-16402 ​ Номер CVE: CVE-2022-22947 2. Затрагиваемые версии: VMWare Spring Cloud Gateway 3.1.0 VMWare Spring Cloud Gateway =3.0.0, =3.0.6 VMWare Spring Cloud Gateway...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Spring Cloud Gateway のリモートコード実行脆弱性に関するセキュリティ通知。この脆弱性は、Spring Cloud Gateway の Gateway Actuator エンドポイントが有効かつ公開されている場合、Spring Cloud Gateway を使用したアプリケーションがコードインジェクション攻撃を受ける可能性があります。攻撃者は特別に細工された悪意のあるリクエストを送信し、リモートで任意のコードを実行できます。 【影響を受けるバージョン】 Spring Cloud Gateway =...

CVE-2022-22947

Spring Cloud Gateway 3.0.7 и 3.1.1 Внедрение кода RCE CVE: CVE-2022-22947 CVSS: 10.0 Vmware - https://tanzu.vmware.com/security/cve-2022-22947 Приложения, использующие Spring Cloud Gateway, уязвимы к атаке внедрения кода, когда конечная точка Gateway Actuator включена, доступна и не защищена...

CVE-2022-22947

CVE-2022-22947 스프링 클라우드 게이트웨이에 대한 코드 인젝션 공격 CVE 요약 스프링 클라우드 게이트웨이 버전 3.1.1+ 및 3.0.7+ 이전 버전에서는 Gateway Actuator 엔드포인트가 활성화되고 노출되며 보안되지 않은 경우 애플리케이션이 코드 인젝션 공격에 취약합니다. 원격 공격자는 악의적으로 조작된 요청을 만들어 원격 호스트에서 임의의 원격 실행을 가능하게 할 수 있습니다. 영향을 받는 버전 Oracle Commerce Guided Search 11.3.2 Oracle Communications...

CVE-2022-22947

Описание уязвимости Spring Cloud Gateway — это новый проект в рамках экосистемы Spring Cloud, призванный заменить Netflix Zuul. Он разработан на основе Spring 5.0+, Spring Boot 2.0+ и WebFlux основан на высокопроизводительной реактивной коммуникационной среде Netty с асинхронной неблокирующей...

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE Введение в CVE-2022-22947 root@kitploit: 危害等级：高危 POC/EXP情况：已公开 CNVD编号：CNNVD-2022-16402 影响范围： Spring Cloud GateWay 3.1.0 Spring Cloud GateWay =3.0.0，=3.0.6 Spring Cloud GateWay 3.0.0 Описание уязвимости В Spring Cloud Gateway существует уязвимость...

CVE-2022-22947

CVE-2022-22947 CVE-2022-22947 개요 Spring Cloud Gateway 원격 코드 실행 취약점CVE-2022-22947은 Spring Cloud Gateway 애플리케이션의 Actuator 엔드포인트에서 발생하며, 활성화되어 있고 공개되어 있으며 안전하지 않은 경우 코드 주입 공격에 취약합니다. 공격자는 이 취약점을 통해 원격 호스트에서 임의의 원격 실행을 허용하는 요청을 악의적으로 생성할 수 있습니다. 영향 받는 버전 root@kitploit: Spring Cloud Gateway 3.1.x 3.1....

CVE-2021-21234

CVE-2021-21234 CVE-2021-21234 Spring Boot ディレクトリトラバーサル spring-boot-actuator-logview は、Spring Boot のアクチュエータエンドポイントとしてシンプルなログファイルビューアを追加するライブラリです。これは Maven パッケージ「eu.hinsch:spring-boot-actuator-logview」です。バージョン 0.2.13 以前の spring-boot-actuator-logview にディレクトリトラバーサルの脆弱性が存在します。このライブラリの本質は、admin（Spring...

CVE-2022-22947-pb-ai

CVE-2022-22947 Spring Cloud Gateway 취약점 검증 애플리케이션 이것은 CVE-2022-22947 취약점을 데모하고 검증하기 위해 특별히 설계된 Spring Cloud Gateway 애플리케이션입니다. 이 애플리케이션은 취약한 버전의 Spring Cloud Gateway를 사용하며, Actuator 엔드포인트를 통해 임의 코드를 실행할 수 있습니다. 취약점 개요 CVE-2022-22947은 Spring Cloud Gateway의 원격 코드 실행 취약점입니다. 공격자는 Actuator 엔드포인트를 통해 ...

CVE-2025-41243-Vulnerability-Lab

CVE-2025-41243: Spring Cloud Gateway RCE Lab Описание уязвимости В Spring Cloud Gateway существует уязвимость внедрения SpEL-выражений. При включении конечной точки Actuator злоумышленник может выполнить удаленный код RCE. Запуск docker-compose up -d Воспроизведение 1. Откройте...

CVE-2026-11458

A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be...

CVE-2026-11458

A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be...

CVE-2026-11458 erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure

A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be...

CVE-2026-11458 erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure

A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be...

EUVD-2026-34988

A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be...

JeeWMS 访问控制错误漏洞

JeeWMS is a JAVA-based warehouse management system developed by JeeWMS Corporation in China. There is an access control vulnerability in JeeWMS, which stems from issues with the handling of files in the /base-boot/actuator directory within the Boot Actuator Endpoint component. This vulnerability...

CVE-2025-62188 Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.. Users are...

CVE-2025-62188 Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.. Users are...

CVE-2025-62188 Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.. Users are...