CVE-2017-8046GHSA-9QF9-28H9-HQCJ
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.6.9.RELEASE, 3.0.1.RELEASE
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 10 proofs of concept on GitHub, 1 Nuclei template
Summary
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-44289
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Pivotal Pivotal Spring Data REST and Spring Boot
Version range not reported
- org.springframework.data:spring-data-rest-coreMaven
fixed in 2.6.9.RELEASE
- org.springframework.data:spring-data-rest-coreMaven
From 3.0.0 · fixed in 3.0.1.RELEASE