CVE-2017-8046

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-8046
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.securityfocus.com/bid/100948 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2405
https://pivotal.io/security/cve-2017-8046 Vendor Advisory
https://www.exploit-db.com/exploits/44289/ Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*
History

07 Apr 2022, 15:03

Type Values Removed Values Added
CPE cpe:2.3:a:pivotal_software:spring_boot:2.0.0:m4:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_boot:2.0.0:m5:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_boot:2.0.0:m2:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_boot:2.0.0:m1:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_boot:*:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_boot:2.0.0:m3:*:*:*:*:*:*		 cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*
Information

Published : 2018-01-04 06:29

Updated : 2024-02-04 19:29

NVD link : CVE-2017-8046

Mitre link : CVE-2017-8046

CVE.ORG link : CVE-2017-8046

JSON object : View

Products Affected

pivotal_software

  • spring_data_rest

vmware

  • spring_boot
CWE
CWE-20

Improper Input Validation