cve.bz

CVE-2022-22980

9.8 criticalEPSS 18%

Critical (9.8) in vmware spring data mongodb. EPSS 18% chance of exploitation in the next 30 days. Fixed in org.springframework.data:spring-data-mongodb 3.3.5, 3.4.1.

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE
CWE-917
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-w24x-87mr-4r23Mavenorg.springframework.data:spring-data-mongodb>=3.4.0 <3.4.13.4.1
GHSA-w24x-87mr-4r23Mavenorg.springframework.data:spring-data-mongodb<3.3.53.3.5

References

Check your stackJSON