CRITICAL🇬🇧 English

CVE-2022-22980

CVSS 9.8v3.1pub. 2022-06-23upd. 2024-11-21

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • VMware Spring Data Mongodb

    APP
    Vmware
    3.4.0≤ 3.3.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2026-41717HIGH8.1ten sam produkt

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue...

CVE-2026-41696MEDIUM5.9ten sam produkt

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform in...

CVE-2025-22224CRITICAL9.3⚠ KEVPL ✓ten sam vendor

VMware ESXi/Workstation: TOCTOU umożliwia ucieczkę z VM przez VMX process

CVE-2024-38812CRITICAL9.8⚠ KEVPL ✓ten sam vendor

VMware vCenter Server — heap-overflow w DCERPC umożliwia RCE

CVE-2024-37079CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Heap overflow w VMware vCenter Server via protokół DCERPC — RCE