PT-2025-42472 · Vmware · Spring Cloud Gateway Server Webflux

Published 2025-10-16 · Updated 2025-11-22 · CVE-2025-41253

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Cloud Gateway Server Webflux (affected versions not specified)

Description Spring Cloud Gateway Server Webflux is susceptible to a SpEL (Spring Expression Language) injection issue. This flaw allows unauthenticated attackers to access environment variables and system properties through maliciously crafted routes. The issue arises when Spring Expression Language is used to access environment variables or system properties via routes, specifically when the Spring Cloud Gateway Server Webflux actuator web endpoint is enabled and unsecured. Successful exploitation can lead to the disclosure of sensitive information, including secrets, credentials, and configuration details. The vulnerability does not affect Spring Cloud Gateway Server WebMVC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2025-41253

GHSA-FWXX-WV44-7QFG

Affected Products

Spring Cloud Gateway Server Webflux

References · 23

• https://cve.org/CVERecord?id=CVE-2025-41253 · Security Note
• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-41253 · Security Note
• https://osv.dev/vulnerability/GHSA-fwxx-wv44-7qfg · Vendor Advisory
• https://github.com/spring-cloud/spring-cloud-gateway · Note
• https://twitter.com/autumn_good_35/status/1979226521316528499 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1ov27sg/top_10_trending_cves_12112025 · Reddit Post
• https://twitter.com/CVEnew/status/1978926599794770226 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/1979350529294606693 · Twitter Post
• https://twitter.com/zoomeye_team/status/1979125540759179645 · Twitter Post
• https://twitter.com/0dayPublishing/status/1978833119990944147 · Twitter Post
• https://spring.io/security/cve/2025-41253 · Note
• https://twitter.com/fridaysecurity/status/1979003202289709397 · Twitter Post
• https://twitter.com/ksg93rd/status/1991341130957365565 · Twitter Post
• https://twitter.com/Komodosec/status/1992371326687068251 · Twitter Post