Description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Remediation
References
https://tanzu.vmware.com/security/cve-2022-22980
Related Vulnerabilities
CVE-2023-40343 Vulnerability in maven package io.jenkins.plugins:tuleap-oauth
CVE-2017-15703 Vulnerability in maven package org.apache.nifi:nifi-authorizer
CVE-2019-10449 Vulnerability in maven package org.jenkins-ci.plugins:fortify-on-demand-uploader
CVE-2023-40178 Vulnerability in npm package @node-saml/node-saml
CVE-2019-10444 Vulnerability in maven package org.jenkins-ci.plugins:bumblebee