Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Remediation

References

http://www.securityfocus.com/bid/100948

https://access.redhat.com/errata/RHSA-2018:2405

https://pivotal.io/security/cve-2017-8046

https://www.exploit-db.com/exploits/44289/

Related Vulnerabilities

CVE-2016-2510 Vulnerability in maven package org.beanshell:bsh

CVE-2018-16487 Vulnerability in maven package org.webjars.npm:lodash.mergewith

CVE-2014-0073 Vulnerability in npm package cordova-plugin-inappbrowser

CVE-2015-8315 Vulnerability in npm package millisecond

CVE-2019-16943 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory CWE-20