RCE in Oracle Banking Branch
CVE-2022-22963
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.999 (100.0th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Oracle Banking Branch — versions 14.5
- Oracle Banking Cash Management — versions 14.5
- Oracle Banking Corporate Lending Process Management — versions 14.5
- Oracle Banking Credit Facilities Process Management — versions 14.5
- Oracle Banking Electronic Data Exchange For Corporates — versions 14.5
- Oracle Banking Liquidity Management — versions 14.2, 14.5
- Oracle Banking Origination — versions 14.5
- Oracle Banking Supply Chain Finance — versions 14.5
- Oracle Banking Trade Finance Process Management — versions 14.5
- Oracle Banking Virtual Account Management — versions 14.5
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- tanzu.vmware.com/security/cve-2022-22963 (Vendor Advisory)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spr… (vendor-advisory, Third Party Advisory)
- www.oracle.com/security-alerts/cpuapr2022.html (Patch, Third Party Advisory)
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 (Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2022.html (Patch, Third Party Advisory)
- packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Executio… (Exploit, VDB Entry, Third Party Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)
Frequently asked questions
- What is CVE-2022-22963?
- CVE-2022-22963 is a critical-severity vulnerability in Oracle Banking Branch, classified under Code Injection. CVSS score: 9.8/10. Published 2022-04-01.
- How severe is CVE-2022-22963?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2022-22963 known to be exploited?
- Yes. CVE-2022-22963 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-08-25), indicating it is being actively exploited. 205 public proof-of-concept repositories are indexed.