GHSA-9qf9-28h9-hqcj

Source

https://github.com/advisories/GHSA-9qf9-28h9-hqcj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9qf9-28h9-hqcj/GHSA-9qf9-28h9-hqcj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9qf9-28h9-hqcj

Aliases

CVE-2017-8046

Published

2022-05-13T01:02:43Z

Modified

2023-11-08T03:59:27.559276Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Remote code execution in PATCH requests in Spring Data REST

Details

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.

Database specific

{
    "nvd_published_at": "2018-01-04T06:29:00Z",
    "github_reviewed_at": "2022-11-04T18:40:40Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Maven / org.springframework.data:spring-data-rest-core

Package

Name: org.springframework.data:spring-data-rest-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-rest-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.9.RELEASE

Affected versions

1.*

1.0.0.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

2.2.4.RELEASE

2.3.0.RELEASE

2.3.1.RELEASE

2.3.2.RELEASE

2.4.0.RELEASE

2.4.1.RELEASE

2.4.2.RELEASE

2.4.4.RELEASE

2.4.5.RELEASE

2.4.6.RELEASE

2.5.0.RELEASE

2.5.1.RELEASE

2.5.2.RELEASE

2.5.3.RELEASE

2.5.4.RELEASE

2.5.5.RELEASE

2.5.6.RELEASE

2.5.7.RELEASE

2.5.8.RELEASE

2.5.9.RELEASE

2.5.10.RELEASE

2.5.11.RELEASE

2.6.0.RELEASE

2.6.1.RELEASE

2.6.2.RELEASE

2.6.3.RELEASE

2.6.4.RELEASE

2.6.5.RELEASE

2.6.6.RELEASE

2.6.7.RELEASE

2.6.8.RELEASE

Maven / org.springframework.data:spring-data-rest-core

Package

Name: org.springframework.data:spring-data-rest-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-rest-core

GHSA-9qf9-28h9-hqcj

Affected packages

Maven / org.springframework.data:spring-data-rest-core

Package

Affected ranges

Affected versions

1.*

2.*

Maven / org.springframework.data:spring-data-rest-core

Package

Affected ranges

Affected versions

3.*