# CVE-2022-22947: Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

Source: https://junglewise.ai/threats/cve-2022-22947-vmware-spring-cloud-gateway-code-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-04. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2022-22947 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-03-04

Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker can send a maliciously crafted request to achieve arbitrary remote code execution on the host.

Technologies: [org.springframework.cloud:spring-cloud-gateway (Maven)](https://junglewise.ai/threats/technologies/org-springframework-cloud-spring-cloud-gateway), [VMware Spring Cloud Gateway](https://junglewise.ai/threats/technologies/spring-cloud-gateway). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2022-22947 exploited in the wild?** Yes. CVE-2022-22947 is known to be exploited in the wild, first recorded on 16 May 2022. Treat it as urgent.

**How severe is CVE-2022-22947?** Critical severity, with a CVSS score of 3.1, published 4 March 2022.

**Which products and versions are affected?** org.springframework.cloud:spring-cloud-gateway (Maven) ECOSYSTEM:introduced=0,fixed=3.0.7.

**Is there a fix for CVE-2022-22947?** Yes. org.springframework.cloud:spring-cloud-gateway (Maven): upgrade to 3.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-22947 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-22947?** Check whether you run org.springframework.cloud:spring-cloud-gateway (Maven) or VMware Spring Cloud Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.cloud:spring-cloud-gateway (Maven): upgrade to 3.0.7 or later

  ```sh
  # set org.springframework.cloud:spring-cloud-gateway to 3.0.7 in your pom.xml or build.gradle
  ```


## Affected products

- VMware Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+
- Oracle Commerce Guided Search 11.3.2
- Oracle Communications Cloud Native Core Binding Support Function 1.11.0, 22.1.3

## Identifiers

- CVE-2022-22947
- GHSA-3gx9-37ww-9qw6

## Timeline

- 2022-05-16: disclosed
- 2022-05-16: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2022-03-01: other: Exploit code published on Packet Storm

## Related threats

- [Spring Cloud Gateway arbitrary proto descriptor location access](https://junglewise.ai/threats/cve-2026-47879-spring-cloud-gateway-arbitrary-proto-descriptor-location-access)
- [VMware Spring Cloud Gateway origin validation error in forwarded headers](https://junglewise.ai/threats/cve-2026-47825-vmware-spring-cloud-gateway-origin-validation-error-in-forwarded)
- [VMware Spring Cloud Gateway ignored SSL bundle configuration](https://junglewise.ai/threats/cve-2026-22750-vmware-spring-cloud-gateway-ignored-ssl-bundle-configuration)
- [Request injection in Spring Cloud Gateway](https://junglewise.ai/threats/cve-2021-22051-request-injection-in-spring-cloud-gateway)