Vulnerabilities > Vmware > Spring Cloud Gateway > 2.2.5

DATE CVE VULNERABILITY TITLE RISK
2022-03-03 CVE-2022-22947 Expression Language Injection vulnerability in multiple products
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
network
low complexity
vmware oracle CWE-917
critical
 10.0
10
2021-11-08 CVE-2021-22051 Incorrect Authorization vulnerability in VMWare Spring Cloud Gateway
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services.
network
low complexity
vmware CWE-863
4.0
4.0