Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2022-22980

CVE-2022-22980 A local based poc of CVE-2022-22980, for the detail of this vulnerability see https://tanzu.vmware.com/security/cve-2022-22980. You need to install mongodb on locahost before running. And I've create a web based poc with docker on dockerv Run mvn spring-boot:run or open with IDEA,...

Spring-Data-Mongodb-Demo

Spring-Data-Mongodb-Demo CVE-2022-22980 Environment...

Security Bulletin: Vulnerability in Spring Data MongoDB might affect IBM Storage Copy Data Management. [CVE-2022-22980]

Summary IBM Storage Copy Data Management can be affected by a vulnerability in Spring Data MongoDB. A remote attacker could exploit this vulnerability to execute arbitrary code on the system as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-2298...

Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb

Springcve-2022-22980 spring data mongodb remote code executio...

ch.sahits.game:openpatriciantest (>=1.0.0, <=1.0.1), com.alipay.sofa:sofa-tracer-mongodb-plugin (>=3.1.0, <=3.1.2) +22 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - ch.sahits.game:openpatriciantest =1.0.0, =3.1.0, =2.1.0.release...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +15 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.10.23.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0, =3.10.0,...

org.sentilo.agent:sentilo-agent-activity-monitor (1.7.0), org.sentilo.agent:sentilo-agent-alert (1.7.0) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.3.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.sentilo.agent:sentilo-agent-activity-monitor 1.7.0 -...

org.springframework.data:spring-data-mongodb-cross-store (1.3.4.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.3.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.activiti.cloud.messages:activiti-cloud-starter-messages-mongodb (7.1.0.m6), org.springframework.boot:spring-boot-starter-data-mongodb (2.1.12.release) +3 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.15.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

io.eventuate.tram.view.support:eventuate-tram-view-support-e2e-tests (>=0.3.0.release, <=0.5.0.release), io.github.daggerok:distributed-lock-mongodb (2.1.1) +30 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

org.springframework.data:spring-data-mongodb-cross-store (1.10.2.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.10.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.github.eagle6688:devutility.external (>=1.0, <=1.0.4), org.springframework.data:spring-data-mongodb-cross-store (2.0.4.release) +2 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.eagle6688:devutility.external =1.0, =2.0.1.release,...

com.breuninger.boot:example-app (>=3.1.1.release, <=3.2.1.release), com.codingapi:codingapi-test (0.0.2) +34 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.breuninger.boot:example-app =3.1.1.release, =1.0.3, =1.0.20...

cn.airfei.air-core:core (3.0.0), com.alpactech:mt-mongo (1.0.0) +40 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (3.4.0)

org.springframework.data:spring-data-mongodb MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.airfei.air-core:core 3.0.0 - com.alpactech:mt-mongo 1.0.0 -...

ch.sahits.game:openpatriciantest (>=0.9.1-rc1, <=0.9.1), cn.minsin:mutils-data-mongodb (>=0.0.2.release, <=0.4.0.release) +14 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - ch.sahits.game:openpatriciantest =0.9.1-rc1, =0.0.2.release,...

com.efindi:smo-filter (0.0.1-release), org.springframework.data:spring-data-mongodb-cross-store (2.0.2.release) +3 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.efindi:smo-filter 0.0.1-release -...

com.capitalone.dashboard:api (>=1.5.0, <=3.2.9), com.capitalone.dashboard:api-audit (>=3.1.0, <=3.4.2) +34 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.8.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:api =1.5.0, =3.1.0, =2.0.4, =2.0.2,...

de.adorsys.multibanking:multibanking-persistence-mongodb (>=5.5.26, <=5.5.43), de.adorsys.multibanking:multibanking-server (>=5.5.26, <=5.5.43) +7 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.21.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.adorsys.multibanking:multibanking-persistence-mongodb...

com.eworkcloud.starter:ework-cloud-starter-mongo (>=2.1.1, <=2.2.9), com.winged-tech:wingedcare-common-mongodb (6.1.3_kc) +14 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.2.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.eworkcloud.starter:ework-cloud-starter-mongo =2.1.1, =1.29....