9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2022-22980

GHSA ID

GHSA-w24x-87mr-4r23

EPSS Score

0.9936%

CWE

CWE-917

Published

6/24/2022

Updated

1/27/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-22980

CVE-2022-22980: SpEL Injection in Spring Data MongoDB

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2022-22980

CVE-2022-22980:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2022-22980

GHSA ID

GHSA-w24x-87mr-4r23

EPSS Score

0.9936%

CWE

CWE-917

Published

6/24/2022

Updated

1/27/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.data:spring-data-mongodb	maven	= 3.4.0	3.4.1
org.springframework.data:spring-data-mongodb	maven	< 3.3.5	3.3.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from unsafe SpEL evaluation in @Query/@Aggregation methods using parameter placeholders. Analysis of Spring Data MongoDB's query processing reveals:

StringBasedMongoQuery.createQuery directly processes SpEL expressions with user parameters
StringBasedAggregation.createPipeline performs similar processing for aggregations
The default EvaluationContextProvider allows dangerous SpEL features These functions appear in stack traces when user input flows into SpEL evaluation through repository methods. The patched versions likely modified parameter handling in these methods to use safer [0] syntax instead of ?0 placeholders and restricted EvaluationContext.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2022-22980: SpEL Injection in Spring Data MongoDB

CVE-2022-22980:

9.1

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2022-22980: SpEL Injection in Spring Data MongoDB

9.1

9.1

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI