PT-2022-3045
CVE-2022-22980
·
تاريخ النشر
2022-06-21
·
تاريخ التحديث
2022-06-30
الوصف من
CVSS 3.1
10
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Spring Data MongoDB (affected versions not specified)
Description
The issue is related to errors in processing SpEL expressions, which can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted SpEL request. This can occur when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding, if the input is not sanitized.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾