Networking-Forums.com

Vulnerability in Spring Cloud Function Framework Affecting Cisco Products: March 2022

<p>On March 29, 2022, the following critical vulnerability in the Spring Cloud Function Framework affecting releases 3.1.6, 3.2.2, and older unsupported releases was disclosed: &nbsp;</p>
<p>CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression</p>
<p>For a description of this vulnerability, see <a href="https://tanzu.vmware.com/security/cve-2022-22963">VMware Spring Framework Security Vulnerability Report</a>.</p>
<p><strong>Cisco's Response to This Vulnerability</strong></p>
<p>Cisco&nbsp;accessed all products for impact from CVE-2022-22963. To help detect exploitation of this vulnerability, Cisco&nbsp;has released Snort rules at the following location: <a href="https://www.snort.org/rule_docs/1-59388">Talos Rule SID 59388</a></p>
<p>This advisory is available at the following link: <br><a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH" target="_blank" rel="noopener">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH</a></p>

     
         
Security Impact Rating:  Critical
   
   
       
CVE: CVE-2022-22963
Source: Vulnerability in Spring Cloud Function Framework Affecting Cisco Products: March 2022 (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Vulnerability%20in%20Spring%20Cloud%20Function%20Framework%20Affecting%20Cisco%20Products:%20March%202022&vs_k=1)