VMware Tanzu known exploited vulnerabilities

Every VMware Tanzu CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 3 in all, 0 added in the last 12 months.

CVE-2022-22963In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toSpring Cloud Function · org.springframework.cloud:spring-cl…Critical · 9.8KEVDue 2022-09-15Fix availableAug 25, 2022
CVE-2020-5410Directory Traversal with spring-cloud-config-serverSpring by VMware Spring Cloud Config · org.springframework.…High · 7.5KEVDue 2022-04-15Fix availableMar 25, 2022
CVE-2018-1273Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitSpring by Pivotal Spring Framework · org.springframework.da…Critical · 9.8KEVDue 2022-04-15RansomwareFix availableMar 25, 2022

Frequently asked questions

How many VMware Tanzu vulnerabilities are in CISA KEV?

3 VMware Tanzu vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2022-22963 (VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability), added 2022-08-25.

Which VMware Tanzu products are in CISA KEV?

3 products, including Spring Cloud, Spring Cloud Configuration (Config) Server, Spring Data Commons. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.

Are VMware Tanzu KEV vulnerabilities used by ransomware?

CISA knows ransomware campaigns exploit 1 of the 3 VMware Tanzu entries.

VMware Tanzu known exploited vulnerabilities

Get alerts for new known exploited vulnerabilities

Frequently asked questions