CVE-2022-22980

Description

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

References

https://github.com/Eliasdekiniweek/CVE-2022-22980

https://github.com/Whoopsunix/PPPVULNS

https://github.com/StarCrossPortal/VulnsDB

https://github.com/murataydemir/CVE-2022-22980

https://github.com/advisories/GHSA-w24x-87mr-4r23

https://github.com/jweny/cve-2022-22980-exp

https://github.com/jweny/cve-2022-22980

https://github.com/li8u99/Spring-Data-Mongodb-Demo

https://github.com/wyunan/CVE-Details

https://tanzu.vmware.com/security/cve-2022-22980

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS