CVSS 6.4 · Medium EPSS 0,27%
Kerentanan Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') pada broadcom spring data keyvalue, broadcom spring data redis. Skor CVSS 3.1 6.4 (Medium) menurut vmware.com.
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| broadcom | spring data keyvalue | Versi 2.7.0 hingga sebelum 2.7.20 |
| broadcom | spring data keyvalue | Versi 3.0.0 hingga sebelum 3.0.16 |
| broadcom | spring data keyvalue | Versi 3.1.0 hingga sebelum 3.1.15 |
| broadcom | spring data keyvalue | Versi 3.2.0 hingga sebelum 3.2.16 |
| broadcom | spring data keyvalue | Versi 3.3.0 hingga sebelum 3.3.17 |
| broadcom | spring data keyvalue | Versi 3.4.0 hingga sebelum 3.4.15 |
| broadcom | spring data keyvalue | Versi 3.5.0 hingga sebelum 3.5.11.1 |
| broadcom | spring data keyvalue | Versi 4.0.0 hingga sebelum 4.0.5.1 |
| broadcom | spring data redis | Versi 2.7.0 hingga sebelum 2.7.20 |
| broadcom | spring data redis | Versi 3.0.0 hingga sebelum 3.0.16 |
| broadcom | spring data redis | Versi 3.1.0 hingga sebelum 3.1.15 |
| broadcom | spring data redis | Versi 3.2.0 hingga sebelum 3.2.16 |
| broadcom | spring data redis | Versi 3.3.0 hingga sebelum 3.3.17 |
| broadcom | spring data redis | Versi 3.4.0 hingga sebelum 3.4.15 |
| broadcom | spring data redis | Versi 3.5.0 hingga sebelum 3.5.11.1 |
| broadcom | spring data redis | Versi 4.0.0 hingga sebelum 4.0.5.1 |