Description

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.

Remediation

References

CVE-2022-22946

Related Vulnerabilities

MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-3579)

Oracle Database Server CVE-2006-3702 Vulnerability (CVE-2006-3702)

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-44952)

MongoDb Other Vulnerability (CVE-2018-20802)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-10682)

Severity

Medium

Classification

CVE-2022-22946 CWE-295 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities