CVE-2022-22963

CriticalKEV

Advisory

Published 3 Apr 2022In the index since 8 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.999; 100th percentile
CISA KEV: Listed; since 25 Aug 2022
Charts affected: 20; of 17,781 indexed, latest versions
Container images: 21; deployed by those charts
Fix available: 1 of 1; affected package

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 21 images.

Affected package	Affected versions	Fixed in	Images
spring-cloud-function-contextmaven	2.0.0.RELEASE, 3.0.10.RELEASE, 3.0.14.RELEASE, 3.2.1	3.1.7, 3.2.3	21

OSV records: GHSA-6v73-fgf6-w5j7

Charts affected

20 by stars

Chart

Latest

Affected images

Radar Score

geoserver-cloudcamptocamp2

0.0.5

5 of 11 See more

geoserver-cloud camptocamp2 0.0.5

5 of the 11 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	spring-cloud-function-context@3.0.10.RELEASE	3.1.7

Open the chart page →

84,444

geoserverCloudcamptocamp2

0.0.6

5 of 11 See more

geoserverCloud camptocamp2 0.0.6

5 of the 11 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	spring-cloud-function-context@3.0.10.RELEASE	3.1.7

Open the chart page →

84,444

geoservercamptocamp2

0.0.3

5 of 12 See more

geoserver camptocamp2 0.0.3

5 of the 12 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
geoservercloud/geoserver-cloud-rest :1.0-RC2	5dc0c93a1710	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wcs :1.0-RC2	47ae1bdb4bcc	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-webui :1.0-RC2	28c3e5a8c5a3	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wfs :1.0-RC2	8c70ee06d5ab	spring-cloud-function-context@3.0.10.RELEASE	3.1.7
geoservercloud/geoserver-cloud-wms :1.0-RC2	42775ba6a4da	spring-cloud-function-context@3.0.10.RELEASE	3.1.7

Open the chart page →

88,335

eoloPlanteolo-planner

0.1.0

1 of 7 See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
mastercloudapps/planner :v1.23	40a950b311b2	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,537

eoloplannereoloplanner

0.1.0

1 of 7 See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
codeurjc/planner :v1.0	800cf520c245	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

32,205

eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelm

0.1.0

1 of 7 See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
mastercloudapps/planner :v1.23	40a950b311b2	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,537

eoloplannereoloplanner-molynx-gat

0.1.0

1 of 7 See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
molynx/planner :v1	441c9f52f092	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

28,482

eolo-plannereolo-planner-repo

0.1.0

1 of 7 See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
arturisimo/planner :v1.0	fff9de644941	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,096

eoloplanteoloplant

1.0.0

1 of 7 See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
mastercloudapps/planner :v1.23	40a950b311b2	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,537

eoloplantseoloplants-urjc

0.1.0

1 of 7 See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
lourdesmorente/new-planner :1.0.0	608745878cdb	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,721

servereoloserver

0.1.0

1 of 7 See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
codeurjc/planner :v1.0	800cf520c245	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

32,205

scorpio-brokerfiware

0.3.3

1 of 10 See more

scorpio-broker fiware 0.3.3

1 of the 10 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
scorpiobroker/scorpio :config-server_1.1.0	c46c1517e523	spring-cloud-function-context@2.0.0.RELEASE	3.1.7

Open the chart page →

55,600

scorpiobrokerfiware

0.1.2

1 of 10 See more

scorpiobroker fiware 0.1.2

1 of the 10 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
scorpiobroker/scorpio :config-server_1.1.0	c46c1517e523	spring-cloud-function-context@2.0.0.RELEASE	3.1.7

Open the chart page →

55,600

eoloplanthttpd-eoloplant

0.1.0

1 of 7 See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
codeurjc/planner :v1.0	800cf520c245	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

32,205

eoloserverihuertas2021-vmartinp2021-helm

0.1.0

1 of 7 See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
huertaslopez/i.huertas.2021-v.martinp.2021-planner :2.0.0	e2c18bd65472	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,721

eoloplantmca-eoloplaner

0.1.0

1 of 7 See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
hugohg34/planner :0.0.2	171f61e8d7e2	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

29,588

Practica_4_helmmy-heml-app

0.1.0

1 of 7 See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
adagber/planner :v1.0	e5c1ed097752	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,721

file-system-ms-helm-chartnotesprojectchart

0.1.0

1 of 2 See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	spring-cloud-function-context@3.0.14.RELEASE	3.1.7

Open the chart page →

5,875

p4p4

0.1.0

1 of 7 See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
mastercloudapps/planner :v1.23	40a950b311b2	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,537

Practica_4_helmpr04helm

0.1.0

1 of 7 See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-22963.

Container image	Digest	Package	Fixed in
pcarrascoponce/planner :v1.0	981fc482442c	spring-cloud-function-context@3.2.1	3.2.3

Open the chart page →

27,558

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mastercloudapps/planner :v1.23	40a950b311b2	spring-cloud-function-context@3.2.1	3.2.3	4
codeurjc/planner :v1.0	800cf520c245	spring-cloud-function-context@3.2.1	3.2.3	3
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	2
scorpiobroker/scorpio :config-server_1.1.0	c46c1517e523	spring-cloud-function-context@2.0.0.RELEASE	3.1.7	2
adagber/planner :v1.0	e5c1ed097752	spring-cloud-function-context@3.2.1	3.2.3	1
arturisimo/planner :v1.0	fff9de644941	spring-cloud-function-context@3.2.1	3.2.3	1
geoservercloud/geoserver-cloud-rest :1.0-RC2	5dc0c93a1710	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	1
geoservercloud/geoserver-cloud-wcs :1.0-RC2	47ae1bdb4bcc	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	1
geoservercloud/geoserver-cloud-webui :1.0-RC2	28c3e5a8c5a3	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	1
geoservercloud/geoserver-cloud-wfs :1.0-RC2	8c70ee06d5ab	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	1
geoservercloud/geoserver-cloud-wms :1.0-RC2	42775ba6a4da	spring-cloud-function-context@3.0.10.RELEASE	3.1.7	1
huertaslopez/i.huertas.2021-v.martinp.2021-planner :2.0.0	e2c18bd65472	spring-cloud-function-context@3.2.1	3.2.3	1
hugohg34/planner :0.0.2	171f61e8d7e2	spring-cloud-function-context@3.2.1	3.2.3	1
lourdesmorente/new-planner :1.0.0	608745878cdb	spring-cloud-function-context@3.2.1	3.2.3	1
molynx/planner :v1	441c9f52f092	spring-cloud-function-context@3.2.1	3.2.3	1
pcarrascoponce/planner :v1.0	981fc482442c	spring-cloud-function-context@3.2.1	3.2.3	1
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	spring-cloud-function-context@3.0.14.RELEASE	3.1.7	1