VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
VMware Tanzu · Spring Cloud
Date added (CISA)
2022-08-25
Remediation due
2022-09-15
Known ransomware use
Not indicated
Remediation priority
P2 — past CISA due date
Description
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.