Threadlinqs IntelligenceStart free

VulnerabilityCVE-2022-22947Published 2022-03-03

CVE-2022-22947 — Spring Cloud Gateway

criticalCISA KEVPublic exploit11 PoC reposNuclei template

As of 2025-10-21, CVE-2022-22947 is a CRITICAL-severity vulnerability in Spring Cloud Gateway, CVSS v3.1 10, EPSS 98.2% (99.9th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-05-16), with a US federal remediation deadline of 2022-06-06. Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2022-22947, most recently “NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool Access”.

CVSS v3.1
10/10Critical
EPSS
98.2%Higher than 99.9% of scored CVEs
CISA KEV
ListedAdded · due 2022-06-06
Tracked threats
2Campaigns referencing it
Priority
9/10Threadlinqs triage score
Published
Updated 2025-10-21
CVSS v3.1 10 (CRITICAL) · EPSS 98.2% (higher than 99.9% of all scored CVEs) · Priority 9/10 · Published 2022-03-03

Last updated:

What is CVE-2022-22947?

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

The record classifies CVE-2022-22947 under weakness class CWE-94. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 1700 days ago.

Severity and exploitation probability

CVSS v3.1 base score
10 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (FIRST)
98.2% probability of exploitation in the next 30 days, higher than 99.9% of all scored CVEs
CISA KEV
Listed since 2022-05-16, federal remediation deadline 2022-06-06
Threadlinqs priority
9/10 — CISA KEV-listed, which Threadlinqs floors at 9
Published
2022-03-03, last modified 2025-10-21

Is CVE-2022-22947 being exploited?

CISA added CVE-2022-22947 to the Known Exploited Vulnerabilities catalog on 2022-05-16, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2022-06-06 under BOD 22-01. Weaponised exploit code for CVE-2022-22947 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2022/CVE-2022-22947.yaml). It currently carries a trending score of 55 in the Threadlinqs vulnerability feed.

Affected products and versions

  • (vendor unspecified): Spring Cloud Gateway

Affected software packages:

  • maven:org.springframework.cloud:spring-cloud-gateway — patched in 3.0.7
  • maven:org.springframework.cloud:spring-cloud-gateway — patched in 3.1.1

How to fix CVE-2022-22947

Fixed versions are recorded for 2 packages: maven:org.springframework.cloud:spring-cloud-gateway 3.0.7, maven:org.springframework.cloud:spring-cloud-gateway 3.1.1. Because CVE-2022-22947 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2022-06-06. No vendor patch reference has been recorded for CVE-2022-22947 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2022-22947

2 tracked threats in the Threadlinqs corpus reference CVE-2022-22947, either in the campaign’s CVE list or as an indicator on the campaign record.

Sources

Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on .

Other references