SpEL Injection in Spring Data MongoDB

2022-06-2400:00:30

Google

osv.dev

0.004 Low

EPSS

Percentile

75.2%

JSON

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

CPENameOperatorVersion
org.springframework.data:spring-data-mongodbeq3.1.0
org.springframework.data:spring-data-mongodbeq1.3.3.RELEASE
org.springframework.data:spring-data-mongodbeq3.0.3.RELEASE
org.springframework.data:spring-data-mongodbeq2.0.14.RELEASE
org.springframework.data:spring-data-mongodbeq2.2.0.RELEASE
org.springframework.data:spring-data-mongodbeq1.5.0.RELEASE
org.springframework.data:spring-data-mongodbeq1.10.4.RELEASE
org.springframework.data:spring-data-mongodbeq1.0.2.RELEASE
org.springframework.data:spring-data-mongodbeq1.10.2.RELEASE
org.springframework.data:spring-data-mongodbeq1.0.0.RELEASE

Name	Operator	Version
org.springframework.data:spring-data-mongodb	eq	3.1.0
org.springframework.data:spring-data-mongodb	eq	1.3.3.RELEASE
org.springframework.data:spring-data-mongodb	eq	3.0.3.RELEASE
org.springframework.data:spring-data-mongodb	eq	2.0.14.RELEASE
org.springframework.data:spring-data-mongodb	eq	2.2.0.RELEASE
org.springframework.data:spring-data-mongodb	eq	1.5.0.RELEASE
org.springframework.data:spring-data-mongodb	eq	1.10.4.RELEASE
org.springframework.data:spring-data-mongodb	eq	1.0.2.RELEASE
org.springframework.data:spring-data-mongodb	eq	1.10.2.RELEASE
org.springframework.data:spring-data-mongodb	eq	1.0.0.RELEASE