description: In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
problem types: CWE-94: Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: n/a
product: Spring Cloud Gateway
versions:
version: Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions, status: affected
}