Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Remediation

References

http://www.securityfocus.com/bid/100948

https://access.redhat.com/errata/RHSA-2018:2405

https://pivotal.io/security/cve-2017-8046

https://www.exploit-db.com/exploits/44289/

Related Vulnerabilities

CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-core-services-api

CVE-2015-7940 Vulnerability in maven package org.bouncycastle:bcprov-jdk16

CVE-2021-21252 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

CVE-2021-39184 Vulnerability in npm package electron

CVE-2023-37895 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-standalone-components

Severity

Critical

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory