spring_cloud_gateway 漏洞

严重CVE-2025-412432025/09/16

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

SpringBoot spring_cloud_gatewayPoC 已收录

CVSS10.0

严重CVE-2022-229472022/03/02

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

spring_cloud_gatewayPoC 已收录EXP 已收录RCE

CVSS10.0EPSS 94.5%

spring_cloud_gateway

关联漏洞

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Code Injection