GHSA-w24x-87mr-4r23
SpEL Injection in Spring Data MongoDB
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-mongodb | >= 3.4.0, < 3.4.1 | 3.4.1 |
| Maven | org.springframework.data:spring-data-mongodb | < 3.3.5 | 3.3.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
References
External links from the advisory. They lead to third-party sites.