What is CVE-2022-22946?

CVE-2022-22946 is a medium-severity vulnerability in Oracle Commerce Guided Search, classified under Improper Certificate Validation. CVSS score: 5.5/10. Published 2022-03-04.

How severe is CVE-2022-22946?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2022-22946 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Oracle Commerce Guided Search

CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.

Vulnerability class: Improper Certificate Validation

Published 2022-03-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.048 (91.7th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 91.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.048 · newest: 0.048 · change: 0.000

Affected products

Oracle Commerce Guided Search — versions 11.3.2
Oracle Communications Cloud Native Core Binding Support Function — versions 22.1.3
Oracle Communications Cloud Native Core Console — versions 22.2.0
Oracle Communications Cloud Native Core Network Repository Function — versions 22.1.2, 22.2.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy — versions 22.1.1
VMware Spring Cloud Gateway — versions 3.1.0
Spring Cloud Gateway — versions Spring cloud gateway versions 3.1.x prior to 3.1.1+

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

Public proof-of-concept exploits

References

tanzu.vmware.com/security/cve-2022-22946 (Vendor Advisory)
www.oracle.com/security-alerts/cpujul2022.html (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-22946?: CVE-2022-22946 is a medium-severity vulnerability in Oracle Commerce Guided Search, classified under Improper Certificate Validation. CVSS score: 5.5/10. Published 2022-03-04.
How severe is CVE-2022-22946?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2022-22946 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.