Skip to content

CVE-2017-8046 Remote code execution in PATCH requests in Spring Data REST

CriticalCVSS 9.8 EPSS 74.5%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Affected products

ProductAffected versionsFixed in
org.springframework.data/spring-data-rest-core(Maven) < 2.6.9.RELEASE 2.6.9.RELEASE
org.springframework.data/spring-data-rest-core(Maven) >= 3.0.0, < 3.0.1.RELEASE 3.0.1.RELEASE
org.springframework.data/spring-data-rest-core(Maven) = 1.0.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.0.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.0.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.0.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.0.3.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.1.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.1.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.1.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.1.4.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.1.5.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.1.6.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.2.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.2.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.2.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.2.3.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.2.4.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.3.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.3.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.3.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.4.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.4.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.4.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.4.4.RELEASE No fix listed
Show 40 more
ProductAffected versionsFixed in
org.springframework.data/spring-data-rest-core(Maven) = 2.4.5.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.4.6.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.10.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.11.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.3.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.4.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.5.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.6.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.7.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.8.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.5.9.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.0.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.1.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.2.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.3.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.4.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.5.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.6.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.7.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 2.6.8.RELEASE No fix listed
org.springframework.data/spring-data-rest-core(Maven) = 3.0.0.RELEASE No fix listed
VMware spring boot < 1.5.9 1.5.9
VMware spring boot = 2.0.0-milestone1 No fix listed
VMware spring boot = 2.0.0-milestone2 No fix listed
VMware spring boot = 2.0.0-milestone3 No fix listed
VMware spring boot = 2.0.0-milestone4 No fix listed
VMware spring boot = 2.0.0-milestone5 No fix listed
pivotal software spring data rest = 3.0.0 No fix listed
pivotal software spring data rest = 3.0.0-m1 No fix listed
pivotal software spring data rest = 3.0.0-m2 No fix listed
pivotal software spring data rest = 3.0.0-m3 No fix listed
pivotal software spring data rest = 3.0.0-m4 No fix listed
VMware spring data rest < 2.6.9 2.6.9
VMware spring data rest = 3.0.0-rc1 No fix listed
VMware spring data rest = 3.0.0-rc2 No fix listed
VMware spring data rest = 3.0.0-rc3 No fix listed
Pivotal Spring Data REST and Spring Boot = Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 No fix listed

References