Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-22980

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter place

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Spring Data MongoDB

  • 3.4.0, 3.3.0 to 3.3.4 and Olderaffected

References