CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

Spring data rest 远程代码执行(cve-2017-8046)

漏洞描述 漏洞描述 Spring Data Rest 在处理 PATCH 请求时存在RCE高危漏洞, 可以使用手工构造的JSON数据构造恶意PATCH请求提交至spring-data-rest服务器，使得服务器运行恶意JAVA代码。Spring Data Rest项目的目标是提供一种灵活的、可配置的机制，编写出可以对外暴露出HTTP协议的简单服务。 Git地址: https://github.com/spring-projects/spring-data-rest 漏洞来源: https://pivotal.io/security/cve-2017-8046 影响版本： Spring...

Code injection

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), br.com.intelipost:sdk-java (>=0.0.1, <=0.0.8) +70 more potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (>=1.0.0.release, <=2.6.8.release)

org.springframework.data:spring-data-rest-core MAVEN version =1.0.0.release, =1.0.0, =0.0.1, =2.3.0-release, =0.0.6, =0.0.1, =0.0.1, =1.0.0, =79, =92 - com.heapbrain:heapaudit 1.0.0 and more Source cves: CVE-2017-8046 Source advisory: MEND:CVE-2017-8046...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

org.springframework.data:spring-data-rest-hal-browser (3.0.0.release), org.springframework.data:spring-data-rest-webmvc (3.0.0.release) potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (3.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

CVE-2017-8046

CVE-2017-8046 is a remote code execution vulnerability affecting Spring Data REST before versions 2.6.9 (Ingalls SR9) and 3.0.1 (Kay SR1), and Spring Boot before 1.5.9 or 2.0 M6. When processing specially crafted JSON in PATCH requests, an attacker could execute arbitrary Java code on affected se...

CVE-2017-8046: Improper Input Validation

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code. Recent assessments: Assessed Attacker Value: 0...

PT-2018-8443

Name of the Vulnerable Software and Affected Versions Spring Data REST versions prior to 2.6.9 Ingalls SR9 Spring Data REST versions prior to 3.0.1 Kay SR1 Spring Boot versions prior to 1.5.9 Spring Boot versions prior to 2.0 M6 Description The issue allows malicious PATCH requests submitted to...

RCE in PATCH requests in Spring Data REST

Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code...