org.springframework.boot:spring-boot-starter-data-mongodb (1.3.8.release), org.springframework.data:spring-data-mongodb-cross-store (1.8.5.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.8.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.8.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

com.avides.springboot.springtainer:springtainer-mongodb (1.0.0), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (1.0.0-rc2) +19 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.2.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.avides.springboot.springtainer:springtainer-mongodb 1.0.0 -...

com.github.softbasic:micro-core (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-mongodb (2.0.7.release) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.softbasic:micro-core =0.0.1, =2.0.4.release,...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-mongodb-conf (3.1.0.release) +53 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.2.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation...

com.github.edgarespina:mwa-mongo (>=0.1.0, <=0.1.6), com.github.edgarespina:mwa-morphia (>=0.1.0, <=0.1.6) +6 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.0.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.1.0, =0.1.0, =2.1, =0.1.0,...

io.rhiot:rhiot-cloudlet-geofencing (0.1.1), io.rhiot:rhiot-iot-cloudlet-document-default (0.1.1) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.6.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - io.rhiot:rhiot-cloudlet-geofencing 0.1.1 -...

cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-mongodb-conf (>=3.0.0.release, <=3.0.1.release), com.github.paulcwarren:content-mongo-spring-boot-starter (>=0.3.0, <=0.4.0) +18 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.epam.reportportal:commons-bugtracking (3.0.0), io.gravitee.am.gateway.handlers:gravitee-am-gateway-handlers (>=1.0.0, <=1.3.0) +13 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.9.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...

org.smarti18n:smarti18n-messages (>=1.0.0, <=1.0-pre7), org.springdoc:springdoc-openapi-test-app3 (3.1.1) +5 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.smarti18n:smarti18n-messages =1.0.0, =5.0.13.release,...

GHSA-W24X-87MR-4R23 SpEL Injection in Spring Data MongoDB

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.7.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.github.edgarespina:mwa-mongo (>=0.2.5, <=0.2.7), com.github.edgarespina:mwa-morphia (>=0.2.5, <=0.2.7) +18 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.2.5, =0.2.5, =0.3.0, =0.3.0...

com.lordofthejars:nosqlunit-mongodb (>=0.7.5, <=0.8.1), org.inigma.shared:inigma-mongo (>=0.4, <=0.6) +3 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.7.5, =0.4, =0.2,...

org.inigma.shared:inigma-mongo (>=0.6.1, <=0.10.0), org.springframework.data:spring-data-mongodb-cross-store (1.1.2.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.inigma.shared:inigma-mongo =0.6.1, =0.10.0 -...

CVE-2022-22980

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

CVE-2022-22980

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

Sql injection

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

Update on Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980)

Background On June 20, 2022 Spring released Spring Data MongoDB 3.4.1 and 3.3.5 to address a critical CVE report: CVE-2022-22980: Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods. This vulnerability was originally reported on June 13, 2022...

Spring Data MongoDB security vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Data MongoDB that stems from vulnerability to SpEL injection when using @Query or...

Spring Data MongoDB Code Execution

The vulnerability of the software for unifying and simplifying access to Spring Data MongoDB databases is related to errors in processing SpEL expressions. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted SpEL query...