Description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Remediation
References
https://tanzu.vmware.com/security/cve-2022-22980
Related Vulnerabilities
CVE-2023-50732 Vulnerability in maven package org.xwiki.platform:xwiki-platform-index-tree-macro
CVE-2019-10247 Vulnerability in maven package org.eclipse.jetty:jetty-server
CVE-2019-10348 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook
CVE-2022-45382 Vulnerability in maven package org.jenkins-ci.plugins:naginator
CVE-2019-10283 Vulnerability in maven package com.mabl.integration.jenkins:mabl-integration