Description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Remediation
References
https://tanzu.vmware.com/security/cve-2022-22980
Related Vulnerabilities
CVE-2021-21341 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2020-1723 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2023-45819 Vulnerability in npm package tinymce
CVE-2019-13173 Vulnerability in maven package org.webjars.npm:fstream
CVE-2022-46363 Vulnerability in maven package org.apache.cxf:cxf-rt-transports-http