CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be…

published March 4, 2022

CVSS
—
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04846 · 92.0th percentile
Published
2022-03-04T15:50Z
EPSS history
Timeline
  • 04 MAR 15:50Z
    In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be…
    cvelistv5