CVE-2017-8046

{"containers": {"cna": {"affected": [{"product": "Pivotal Spring Data REST and Spring Boot", "vendor": "Pivotal", "versions": [{"status": "affected", "version": "Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6"}]}], "datePublic": "2018-01-04T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code."}], "problemTypes": [{"descriptions": [{"description": "run arbitrary Java code", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-15T09:57:01.000Z", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://pivotal.io/security/cve-2017-8046"}, {"name": "RHSA-2018:2405", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:2405"}, {"name": "100948", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100948"}, {"name": "44289", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/44289/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "ID": "CVE-2017-8046", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Pivotal Spring Data REST and Spring Boot", "version": {"version_data": [{"version_value": "Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6"}]}}]}, "vendor_name": "Pivotal"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "run arbitrary Java code"}]}]}, "references": {"reference_data": [{"name": "https://pivotal.io/security/cve-2017-8046", "refsource": "CONFIRM", "url": "https://pivotal.io/security/cve-2017-8046"}, {"name": "RHSA-2018:2405", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:2405"}, {"name": "100948", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100948"}, {"name": "44289", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/44289/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:19:29.628Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://pivotal.io/security/cve-2017-8046"}, {"name": "RHSA-2018:2405", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:2405"}, {"name": "100948", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100948"}, {"name": "44289", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/44289/"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2017-8046", "datePublished": "2018-01-04T06:00:00.000Z", "dateReserved": "2017-04-21T00:00:00.000Z", "dateUpdated": "2024-08-05T16:19:29.628Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Pivotal Spring Data REST and Spring Boot", "vendor": "Pivotal", "versions": [{"status": "affected", "version": "Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D178DD5-5C7C-4954-AE5C-7805EEE0869B", "versionEndExcluding": "1.5.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*", "matchCriteriaId": "141F2C99-AD34-4003-81D4-689F3F1A53ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*", "matchCriteriaId": "D7929E66-FCA2-4D1B-B29F-55BF70AF70C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*", "matchCriteriaId": "E6B93CDA-E5D9-4955-910A-22B38779F23C", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*", "matchCriteriaId": "F324F68E-CF50-4F2E-90E4-3620CE05A944", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*", "matchCriteriaId": "C120785F-A827-4870-B33B-679367A9EB20", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "CB3CC672-C90E-40FD-890F-93C4F5338513", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*", "matchCriteriaId": "360B3EDD-18D5-44D7-A998-89F55DD9F5E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*", "matchCriteriaId": "95140537-ECA9-4A68-BD05-AEE47C36DD94", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*", "matchCriteriaId": "47F7A32E-5F18-4651-842D-968FE380AA98", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*", "matchCriteriaId": "BCCDFF26-CF5B-44A6-8EDE-0A5353C669DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B3342AA-A589-465D-A8B0-8875EF656A99", "versionEndExcluding": "2.6.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "CD27BB87-38F1-4294-B34C-7552A367D36D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "9ED5009A-D7B9-45E8-B439-BC09DB47718D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "34316476-8B3D-4E70-8B02-E85A62B37002", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code."}, {"lang": "es", "value": "Las peticiones PATCH maliciosas enviadas a servidores que utilizan versiones Spring Data REST anteriores a la 2.6.9 (Ingalls SR9), versiones anteriores a la 3.0.1 (Kay SR1) y versiones Spring Boot anteriores a la 1.5.9, 2.0 M6 pueden utilizar datos JSON especialmente dise\u00f1ados para ejecutar c\u00f3digo Java arbitrario."}], "id": "CVE-2017-8046", "lastModified": "2026-06-26T18:44:14.703", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-04T06:29:00.307", "references": [{"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100948"}, {"source": "security_alert@emc.com", "url": "https://access.redhat.com/errata/RHSA-2018:2405"}, {"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://pivotal.io/security/cve-2017-8046"}, {"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/44289/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100948"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:2405"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://pivotal.io/security/cve-2017-8046"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/44289/"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:2405", "cpe": "cpe:/a:redhat:jboss_fuse:6.3", "package": "spring-boot", "product_name": "Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7", "release_date": "2018-08-14T00:00:00Z"}], "bugzilla": {"description": "spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code", "id": "1553024", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553024"}, "csaw": false, "cvss3": {"cvss3_base_score": "10.0", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "status": "verified"}, "details": ["Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code."], "name": "CVE-2017-8046", "package_state": [{"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Not affected", "package_name": "spring-boot", "product_name": "Red Hat OpenShift Application Runtimes"}], "public_date": "2018-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-8046\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-8046"], "statement": "While there might be compatibility issues upgrading Spring REST Data independently of the Spring Boot version we recommend that customers make sure they are using a fixed version of Spring Data REST 2.6.9, or 3.0.1. RHOAR has now upgraded to version 1.5.10 of Spring Boot which is compatible with fixed versions of Spring DATA Rest.", "threat_severity": "Critical"}

{}