CVE-2022-22946: 
Oracle Communications CNC BSF vulnerability analysis and mitigation

CVE-2022-22946 affects Spring Cloud Gateway versions prior to 3.1.1+. The vulnerability was discovered and reported on March 1, 2022, by Benjamin Bargeton from BNP Paribas. Applications using Spring Cloud Gateway that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager (Spring Security, NVD).

The vulnerability has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified as CWE-295 (Improper Certificate Validation). When HTTP2 is enabled without proper key store or trusted certificates configuration, the gateway uses an insecure TrustManager, which compromises the security of connections to remote services (NVD).

The vulnerability makes the gateway able to connect to remote services with invalid or custom certificates, potentially compromising the security of communications between services. This could lead to man-in-the-middle attacks or unauthorized access to sensitive information (Spring Security).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is required for exploitation. The scope is unchanged, with no impact on confidentiality but high impact on integrity (NVD).

Users of affected versions should upgrade to Spring Cloud Gateway version 3.1.1+ to address this vulnerability. No other steps are necessary after the upgrade. The fix has been implemented in all releases from version 3.1.1 and onwards (Spring Security).