CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Score

CVSS 3.0 9.8 Critical

Status

Modified - security_alert@emc.com

Published

2018-01-04

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Pivotal Spring Data Rest And Spring Boot (Pivotal)
• Spring Data Rest (Pivotal Software)
• Spring Boot (Vmware)
• Spring Data Rest (Vmware)

References

• http://www.securityfocus.com/bid/100948
• https://access.redhat.com/errata/RHSA-2018:2405
• https://pivotal.io/security/cve-2017-8046
• https://www.exploit-db.com/exploits/44289/