| Reporter | Title | Published | Views | Family All 36 |
|---|---|---|---|---|
 | Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution Ex | 16 Mar 201800:00 | – | zdt |
 | Exploit for Improper Input Validation in Vmware Spring_Boot | 8 Mar 201815:29 | – | githubexploit |
| Exploit for Improper Input Validation in Vmware Spring_Boot | 9 Mar 201820:51 | – | githubexploit |
| Exploit for Incomplete List of Disallowed Inputs in Fasterxml Jackson-Databind | 4 Dec 201710:07 | – | githubexploit |
 | CVE-2017-8046 | 4 Jan 201800:00 | – | attackerkb |
 | CVE-2017-8046 | 18 Dec 202310:21 | – | circl |
 | Pivotal Spring Data REST Remote Code Execution Vulnerability | 22 Sep 201700:00 | – | cnvd |
 | Pivotal Spring PATCH Request Remote Code Execution (CVE-2017-8046) | 9 Nov 201700:00 | – | checkpoint_advisories |
 | CVE-2017-8046 | 4 Jan 201806:00 | – | cvelist |
 | Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution | 15 Mar 201800:00 | – | exploitdb |
10
Node
OR
Node
OR
[
{
"product": "Pivotal Spring Data REST and Spring Boot",
"vendor": "Pivotal",
"versions": [
{
"status": "affected",
"version": "Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6"
}
]
}
]| Source | Link |
|---|---|
| exploit-db | www.exploit-db.com/exploits/44289/ |
| pivotal | www.pivotal.io/security/cve-2017-8046 |
| securityfocus | www.securityfocus.com/bid/100948 |
| access | www.access.redhat.com/errata/RHSA-2018:2405 |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| path | request body | product | JSON Patch data can trigger SpEL evaluation leading to remote code execution on vulnerable Spring Data REST servers. | CWE-20 |
| op | request body | product | JSON Patch data can trigger SpEL evaluation leading to remote code execution on vulnerable Spring Data REST servers. | CWE-20 |
| value | request body | product | JSON Patch data can trigger SpEL evaluation leading to remote code execution on vulnerable Spring Data REST servers. | CWE-20 |
| path | request body | people | JSON Patch data can trigger SpEL evaluation leading to remote code execution on vulnerable Spring Data REST servers. | CWE-20 |
| op | request body | people | JSON Patch data can trigger SpEL evaluation leading to remote code execution on vulnerable Spring Data REST servers. | CWE-20 |
| value | request body | people | JSON Patch data can trigger SpEL evaluation leading to remote code execution on vulnerable Spring Data REST servers. | CWE-20 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
26 Jun 2026 18:44Current
9.2High risk
Vulners AI Score9.2
CVSS 27.5
CVSS 39.8
EPSS0.7453