GitHub Advisoryadvisory · Maven

GHSA-9qf9-28h9-hqcj Remote code execution in PATCH requests in Spring Data REST

CRITICAL Published 2022-05-13 Modified 2022-11-04 Official page ↗
Aliases
CVE-2017-8046
Ecosystem
Maven
Packages
org.springframework.data:spring-data-rest-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-11-04

Affected packages

• Maven org.springframework.data:spring-data-rest-core: < 2.6.9.RELEASE → fixed in 2.6.9.RELEASE • Maven org.springframework.data:spring-data-rest-core: >= 3.0.0, < 3.0.1.RELEASE → fixed in 3.0.1.RELEASE

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.

Related

Alias · CVE (1)

  • CVE-2017-8046 Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References