Description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Remediation
References
https://tanzu.vmware.com/security/cve-2022-22980
Related Vulnerabilities
CVE-2023-45136 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2021-3424 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-24454 Vulnerability in maven package org.jenkins-ci.plugins:testquality-updater
CVE-2022-34212 Vulnerability in maven package org.jenkins-ci.plugins:vmware-vrealize-orchestrator
CVE-2019-10390 Vulnerability in maven package com.splunk.splunkins:splunk-devops