CVE-2022-22980

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

CVE-2022-22980

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb

CVE-2022-22980 A local based poc of CVE-2022-22980, for the d...

SpEL Injection Attacks

spring-data-mongodb is vulnerable to Spring Expression Language SpEL injection. The vulnerability exists due to the non-sanitized input in the repository query method, allowing an attacker to inject and execute malicious SpEL to the repository query method when it is annotated with @Query or...

Security Bulletin: IBM Security Guardium is affected by a mongodb-driver-legacy-4.1.1.jar vulnerability (CVE-2021-20328)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2021-20328 DESCRIPTION: MongoDB Java driver is vulnerable to a man-in-the-middle attack, caused by improper host name verification on the KMS server's certificate. An attacker could exploit this...

Malicious code in moonbeam-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e8999054fa21ea2342ad98d26a3058503720057689847909ecac60f10ec221c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4694 Malicious code in moonbeam-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e8999054fa21ea2342ad98d26a3058503720057689847909ecac60f10ec221c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980)

Updates 06-20 CVE-2022-22980 is published 06-20 Spring Data MongoDB 3.4.1 and 3.3.5 are available Table of Contents Overview Vulnerability Am I Impacted Status Suggested Workarounds Overview We would like to announce that we have released Spring Data MongoDB 3.4.1 and 3.3.5 to address the followi...

Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized. Specifically, an application is vulnerable when all of the...

Possible prototype pollution in Schema.path

Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows...

A Long-Awaited Defense Against Data Leaks May Have Just Arrived

MongoDB claims its new “Queryable Encryption” lets users search their databases while sensitive data stays encrypted. Oh, and its cryptography is open source...

Rocket.Chat: Regex account takeover

Summary: get admin reset token with authenticated user Description: normal user login can access to admin reset token and set a new password for admin user Releases Affected: 3.18.5 3.0.5 Steps To Reproduce from initial installation to vulnerability: Add details for how we can reproduce the issue...

Improper Certificate Validation in MongoDB

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...

admin-gp (>=1.0.0-beta, <=1.0.4-beta), aspiesolutions_core (>=0.0.1-alpha+3, <=0.0.1-alpha.11) +40 more potentially affected by CVE-2021-20332 via mongodb (1.2.5)

mongodb CARGO version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on mongodb and may be impacted: - admin-gp =1.0.0-beta, =0.0.1-alpha+3, =1.0.0, =1.1.0, =1.6.2, =0.12.8, =0.3.0, =0.4.2, =0.1.0-pre-alpha.1, =0.1.0, =1.0.0-beta, =0.1.0, =0.3.1 an...

GHSA-4RJR-3GJ2-5CRQ Exposure of Sensitive Information to an Unauthorized Actor in MongoDB Rust Driver

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credential...

Exposure of Sensitive Information to an Unauthorized Actor in MongoDB Rust Driver

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credential...

MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener

Specific versions of the MongoDB C Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser",...

GHSA-P9RV-QGQW-JX2W MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener

Specific versions of the MongoDB C Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser",...

GHSA-6CWM-WM82-HGRW MongoDB Tools Improper Certificate Validation vulnerability

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...

MongoDB Tools Improper Certificate Validation vulnerability

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...