CVE-2025-41243

Published Sep 16, 2025

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-41243 is a vulnerability in Spring Cloud Gateway Server WebFlux that allows attackers to modify Spring Environment properties through the Spring Expression Language (SpEL). Disclosed on September 8, 2025, the vulnerability exists when an application uses Spring Cloud Gateway Server WebFlux, includes the Spring Boot actuator as a dependency, enables the Gateway Server WebFlux actuator web endpoint via `management.endpoints.web.exposure.include=gateway`, and exposes unsecured actuator endpoints. Successful exploitation of this vulnerability can allow attackers to manipulate sensitive Spring Environment properties. The vulnerability is due to the `GatewayEvaluationContext` constructor not disabling property assignment in the SpEL `EvaluationContext`, which could allow a crafted SpEL expression to modify application properties. To mitigate this, users are advised to upgrade to patched versions or secure their actuator endpoints.

Description: Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
Source: security@vmware.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@vmware.com: CWE-94

Hype score: Not currently trending

References