by Kastro
Paper/Archive/CVE-2025-41243

CVE-2025-41243

Spring Cloud Gateway — Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

EPSS 4%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 89.7.897 × 2017.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Affected

ProductAffectedFixed inSource
Cloud Gateway4.3.x – < 4.3.14.3.1CNA
Cloud Gateway4.2.x – < 4.2.54.2.5CNA
Cloud Gateway4.1.x, 4.0.x – < 4.1.114.1.11CNA
Cloud Gateway3.1.x – < 3.1.113.1.11CNA

Scores by source

vmware (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refspring.io/security/cve-2025-41243