CVE-2022-22980: vmware spring_data_mongodb Expression Language Injection

Vulnerability summary

CVE-2022-22980 is a critical (CVSS 9.8) Expression Language Injection vulnerability in vmware spring_data_mongodb. EPSS estimates a 17.84% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities.

Timeline

1. 22-06-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

• CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.