Critical severity9.4NVD Advisory· Published Sep 24, 2022· Updated Jun 17, 2026

CVE-2022-23463

Description

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.nepxion:discoveryMaven	<= 6.16.2	—

Affected products

Nepxion/Discovery2 versions
cpe:2.3:a:nepxion:discovery:*:*:*:*:*:spring_cloud:*:*+ 1 more
- cpe:2.3:a:nepxion:discovery:*:*:*:*:*:spring_cloud:*:*range: <=6.16.2
- (no CPE)range: 6.16.2
ghsa-coords
pkg:maven/com.nepxion/discovery
Range: <= 6.16.2

Patches

Vulnerability mechanics

References

securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery/nvdExploitThird Party Advisory
github.com/advisories/GHSA-q979-9m39-23mqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-23463ghsaADVISORY
securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_DiscoveryghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.611
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000