Description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Remediation
References
https://tanzu.vmware.com/security/cve-2022-22980
Related Vulnerabilities
CVE-2015-1814 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2018-11788 Vulnerability in maven package org.apache.karaf.specs:org.apache.karaf.specs.java.xml
CVE-2023-24454 Vulnerability in maven package org.jenkins-ci.plugins:testquality-updater
CVE-2020-1947 Vulnerability in maven package org.apache.shardingsphere:shardingsphere
CVE-2020-26870 Vulnerability in maven package org.webjars.bower:dompurify