CVE-2017-8046

Summary

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Impact & exploitability

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

• NVD record
• https://pivotal.io/security/cve-2017-8046Advisory
• http://www.securityfocus.com/bid/100948Advisory
• https://access.redhat.com/errata/RHSA-2018:2405
• https://www.exploit-db.com/exploits/44289/Advisory