Description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Remediation
References
https://tanzu.vmware.com/security/cve-2022-22980
Related Vulnerabilities
CVE-2020-5410 Vulnerability in maven package org.springframework.cloud:spring-cloud-config-server
CVE-2022-24823 Vulnerability in maven package io.netty:netty-common
CVE-2018-1229 Vulnerability in maven package org.springframework.batch:spring-batch-admin
CVE-2019-11358 Vulnerability in npm package jquery
CVE-2023-28680 Vulnerability in maven package org.jenkins-ci.plugins:crap4j