CVE-2017-8046

Опубликовано: 04 янв. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Ссылки

http://www.securityfocus.com/bid/100948
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2405
https://pivotal.io/security/cve-2017-8046
Vendor Advisory
https://www.exploit-db.com/exploits/44289/
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/100948
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2405
https://pivotal.io/security/cve-2017-8046
Vendor Advisory
https://www.exploit-db.com/exploits/44289/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*

Версия до 1.5.9 (исключая)

cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*

Версия до 2.6.9 (исключая)

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.93978

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2017-8046

CVSS3: 10

redhat

почти 8 лет назад

GHSA-9qf9-28h9-hqcj