WaratekVRT Sign in

Critical Org.springframework.data CVEs

3 CVEs, 2 exploited, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor org.springframework.data✕
Overview 3 matches · 2 protected · 2 exploited · 1 CISA KEV · 2 EPSS ≥ 0.5
3matches 2protected66.7% 2exploited66.7% 1CISA KEV33.3% 2EPSS ≥ 0.566.7%
Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 66.7% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Mitigation candidate: 1Protected by Waratek: 2 Critical: 3 not blocked: 1blocked by ARMR today: 2 Proof of concept only: 1Exploited: 2
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q2 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 221 Mitigation candidate1 Critical1 not blocked1 Proof of concept only1
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-22980 Critical 2022-06-23 Mitigation candidate Proof of concept only A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2017-8046 Critical 2018-01-04 Protected by Waratek Exploited Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.