CVE-2022-23463 - CVE House
Back to Database
Status published Critical CVE-2022-23463

SpEL Injection in Nepxion Discovery

Vulnerability Description

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23463

Credits & Attribution

No credits recorded in the NVD database.

References

More from Nepxion

View All →
CVE-2022-23464
Potential Server Side Request Forgery (SSRF) in Nepxion Discovery
Medium 4.3

Affected Vendor

Affected Software

Discover
Vulnerable Versions:
6.16.2

Timeline

Official Publish: September 24th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-917

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.