Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Affected Platforms
Oracle Communications Cloud Native Core Network Repository FunctionOracle Retail Xstore Point Of ServiceOracle Banking Credit Facilities Process ManagementVmware Spring Cloud FunctionOracle Sd-Wan EdgeOracle Banking Virtual Account ManagementOracle Banking BranchOracle Communications Cloud Native Core Network Exposure FunctionOracle Banking Corporate Lending Process ManagementOracle Banking Electronic Data Exchange For Corporates