A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.springframework.data:spring-data-mongodb(Maven) | 3.4.0 | 3.4.1 | N/A |
| org.springframework.data:spring-data-mongodb(Maven) | 0 | 3.3.5 | N/A |
CVSS Metrics
