In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Spring Cloud Gateway",
    "versions": [
      {
        "version": "Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions",
        "status": "affected"
      }
    ]
  }
]