CVE-2017-8046: pivotal_software spring_data_rest Improper Input Validation
Vulnerability summary
CVE-2017-8046 is a critical (CVSS 9.8) Improper Input Validation vulnerability in pivotal_software spring_data_rest. EPSS estimates a 74.53% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-01-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
74.53%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 74.53% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSpring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Vmware2 products
- spring_boot< 1.5.9 | 2.0.0:milestone1 | 2.0.0:milestone2 | 2.0.0:milestone3 | 2.0.0:milestone4 | 2.0.0:milestone5
- spring_data_rest< 2.6.9 | 3.0.0:rc1 | 3.0.0:rc2 | 3.0.0:rc3
Org.springframework.data1 product
- spring-data-rest-core< 2.6.9.RELEASE | ≥ 3.0.0, < 3.0.1.RELEASE
Pivotal1 product
- pivotal spring data rest and spring bootPivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6
Pivotal_software1 product
- spring_data_rest3.0.0 | 3.0.0:m1 | 3.0.0:m2 | 3.0.0:m3 | 3.0.0:m4
4 vendors · 5 products
