CVEvulnerability

CVE-2022-23463

9.8 CRITICAL Published 2022-09-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-09-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.4 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-917

Description

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.

Affected configurations

• nepxion discovery (<= 6.16.2)

Related

Weakness · CWE (1)

  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References