Critical severity · published Jan 4, 2018
CVE-2017-8046
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to…
9.8
CVSS
74.5%
EPSS
No
On KEV
Description
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)74.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Spring Boot · Vmware
before 1.5.9; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0 · source: NVD
SD
Spring Data Rest · Pivotal Software
3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8046
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8046
Third Party Advisory
http://www.securityfocus.com/bid/100948
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2405
Vendor Advisory
https://pivotal.io/security/cve-2017-8046
Third Party Advisory
https://www.exploit-db.com/exploits/44289/
More from Spring Data Rest
9.8
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of…
7.5
CVE-2018-1259
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability…
7.5
CVE-2018-1274
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation