Main Vulnerability Database Vulnerabilities #VU64524

Expression Language Injection in Spring Data MongoDB - CVE-2022-22980

Published: June 21, 2022 / Updated: July 14, 2022

Vulnerability identifier: #VU64524

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22980

CWE-ID: CWE-917

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to SpEL injection issue through annotated repository query methods. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Spring Data MongoDB
IBM Planning Analytics Workspace
Storage Copy Data Management
Storage Protect Plus Server
Autodesk Infraworks

How to mitigate CVE-2022-22980

Install updates from vendor's website.

Spring Data MongoDB - addressed in versions 3.3.5, 3.4.1
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
IBM Planning Analytics Workspace - update to 2.0.82
Storage Copy Data Management - update to 2.2.23.0
Storage Protect Plus Server - update to 10.1.16.1

Links to Public Exploits and PoC-codes

External References

https://tanzu.vmware.com/security/cve-2022-22980