VULNERABILITY INTELLIGENCE

CVE-2022-23463

CVSS score9.4 CRITICAL
EPSS probability2.26%
CISA KEVNot currently listed
Published2022-09-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Description

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.

Weakness classification

  • security-advisories@github.com: CWE-917

Primary references