CVE-2017-8046

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-8046

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8046.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-8046

Aliases

GHSA-9qf9-28h9-hqcj

Published

2018-01-04T06:29:00.307Z

Modified

2026-07-08T05:51:46.434486664Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*",
                "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*",
                "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*",
                "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*"
            ],
            "vendor_product": "pivotal_software:spring_data_rest",
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.0.0"
                },
                {
                    "introduced": "3.0.0-m1"
                },
                {
                    "last_affected": "3.0.0-m1"
                },
                {
                    "introduced": "3.0.0-m2"
                },
                {
                    "last_affected": "3.0.0-m2"
                },
                {
                    "introduced": "3.0.0-m3"
                },
                {
                    "last_affected": "3.0.0-m3"
                },
                {
                    "introduced": "3.0.0-m4"
                },
                {
                    "last_affected": "3.0.0-m4"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/spring-projects/spring-boot

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-boot

Events

Introduced

Fixed

1e8b9569d3a3900a0ed61712099823ad735b8078

Introduced

a9503abb94b203a717527b81a94dc9d3cb4b1afa

Last affected

1c02e9e1eafa19ff7753d56105ed1f6fad5d2b9d

Database specific

{
    "cpe": [
        "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.9"
        },
        {
            "introduced": "2.0.0-milestone1"
        },
        {
            "last_affected": "2.0.0-milestone1"
        },
        {
            "introduced": "2.0.0-milestone2"
        },
        {
            "last_affected": "2.0.0-milestone2"
        },
        {
            "introduced": "2.0.0-milestone3"
        },
        {
            "last_affected": "2.0.0-milestone3"
        },
        {
            "introduced": "2.0.0-milestone4"
        },
        {
            "last_affected": "2.0.0-milestone4"
        },
        {
            "introduced": "2.0.0-milestone5"
        },
        {
            "last_affected": "2.0.0-milestone5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

2.*

2.0.0-milestone1

2.0.0-milestone2

2.0.0-milestone3

2.0.0-milestone4

2.0.0-milestone5

v1.*

v1.0.0.RC3

v1.0.0.RC4

v2.*

v2.0.0.M5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8046.json"

Git / github.com/spring-projects/spring-data-rest

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-data-rest

Events

Introduced

Fixed

6f83d86552ff676d48100e10b327d759c0fa44fd

Introduced

e54f90821877d36d2eea37dea1255b223eae647f

Last affected

c3dc9ebfaf232b6295e2bad5f40c306d7b21ba8a

Database specific

{
    "cpe": [
        "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.9"
        },
        {
            "introduced": "3.0.0-rc1"
        },
        {
            "last_affected": "3.0.0-rc1"
        },
        {
            "introduced": "3.0.0-rc2"
        },
        {
            "last_affected": "3.0.0-rc2"
        },
        {
            "introduced": "3.0.0-rc3"
        },
        {
            "last_affected": "3.0.0-rc3"
        }
    ]
}

Affected versions

2.*

2.0.0.M1

2.0.0.RC1

2.0.0.RELEASE

2.1.0.M1

2.1.0.RC1

2.1.0.RELEASE

2.2.0.M1

2.2.0.RC1

2.2.0.RELEASE

2.3.0.M1

2.3.0.RC1

2.3.0.RELEASE

2.4.0.M1

2.4.0.RC1

2.4.0.RELEASE

2.5.0.M1

2.5.0.RC1

2.5.0.RELEASE

2.6.0.M1

2.6.0.RC1

2.6.0.RELEASE

2.6.1.RELEASE

2.6.2.RELEASE

2.6.3.RELEASE

2.6.4.RELEASE

2.6.5.RELEASE

2.6.6.RELEASE

2.6.7.RELEASE

2.6.8.RELEASE

3.*

3.0.0-rc1

3.0.0-rc2

3.0.0-rc3

3.0.0.RC1

3.0.0.RC2

3.0.0.RC3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8046.json"