CVE-2022-23463
published 2022-09-24CVE-2022-23463: Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.73%
74.7th percentile
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nepxion | discover | 6.16.2 – 6.16.2 | — |
| nepxion | discovery | <= 6.16.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution
osv·2022-09-25
CVE-2022-23463 [CRITICAL] Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution
Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.
GHSA
Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution
ghsa·2022-09-25
CVE-2022-23463 [CRITICAL] CWE-917 Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution
Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-24
Published