CVE-2022-22980

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-22980
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22980.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-22980
Aliases
Published
2022-06-22T13:56:00Z
Modified
2026-10-21T02:47:37Z
Summary
[none]
Details

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Database specific 
{
    "cna_assigner":  "vmware",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22980.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "3.3.4"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "VersionTextExtraction"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-data-mongodb

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-data-mongodb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
e704f147adfb4abca14fa9c8c58c4f442a1c4084
Introduced
9cdc79a89a7d2ebfa39596753ff846629f4258b2
Last Affected
9cdc79a89a7d2ebfa39596753ff846629f4258b2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.3.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:vmware:spring_data_mongodb:3.4.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.4.0"
                },
                {
                    "last_affected":  "3.4.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*
1.0.0.M1-MongoDB
1.0.0.M2-MongoDB
1.0.0.M3-MongoDB
1.0.0.M4-MongoDB
1.0.0.M5-MongoDB
1.0.0.RC1-MongoDB
1.0.0.RELEASE
1.1.0.M1
1.1.0.M2
1.1.0.RC1
1.1.0.RELEASE
1.1.1.RELEASE
1.10.0.M1
1.2.0.RELEASE
1.3.0.M1
1.3.0.RC1
1.3.0.RELEASE
1.4.0.M1
1.4.0.RC1
1.4.0.RELEASE
1.5.0.M1
1.5.0.RC1
1.5.0.RELEASE
1.6.0.M1
1.6.0.RC1
1.6.0.RELEASE
1.7.0.M1
1.7.0.RC1
1.7.0.RELEASE
1.8.0.M1
1.8.0.RC1
1.8.0.RELEASE
1.9.0.M1
1.9.0.RC1
1.9.0.RELEASE
2.*
2.0.0.M1
2.0.0.M2
2.0.0.M3
2.0.0.M4
2.0.0.RC1
2.0.0.RC2
2.0.0.RC3
2.0.0.RELEASE
2.1.0.M1
2.1.0.M2
2.1.0.M3
2.1.0.RC1
2.1.0.RC2
2.1.0.RELEASE
2.2.0.M1
2.2.0.M2
2.2.0.M3
2.2.0.M4
2.2.0.RC1
2.2.0.RC2
2.2.0.RC3
2.2.0.RELEASE
3.*
3.0.0.M1
3.0.0.M2
3.0.0.M3
3.0.0.M4
3.0.0.RC1
3.0.0.RC2
3.0.0.RELEASE
3.1.0
3.1.0-M1
3.1.0-M2
3.1.0-RC1
3.1.0-RC2
3.2.0
3.2.0-M1
3.2.0-M2
3.2.0-M3
3.2.0-M4
3.2.0-M5
3.2.0-RC1
3.3.0
3.3.0-M1
3.3.0-M2
3.3.0-M3
3.3.0-RC1
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22980.json"