Read the docs
TI-2017-05637 Aliases CVE-2017-8046GHSA-9qf9-28h9-hqcj

Improper input validation in Pivotal Spring Data REST and Spring Boot

Priority HIGH 81CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Why it matters now

EPSS 0.7453 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed org.springframework.data:spring-data-rest-core (Maven): 2.6.9.RELEASE, 3.0.1.RELEASERed Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PivotalPivotal Spring Data REST and Spring BootPivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6—No fix listedCNA
—org.springframework.data:spring-data-rest-core (Maven)before 2.6.9.RELEASE2.6.9.RELEASEPatch availableGHSA-9qf9-28h9-hqcj
—org.springframework.data:spring-data-rest-core (Maven)3.0.0 to before 3.0.1.RELEASE3.0.1.RELEASEPatch availableGHSA-9qf9-28h9-hqcj
  • Pivotal Spring Data REST and Spring Boot VendorPivotal Affected Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 Fixed in — No fix listed CNA
  • org.springframework.data:spring-data-rest-core (Maven) Vendor— Affected before 2.6.9.RELEASE Fixed in 2.6.9.RELEASE Patch available GHSA-9qf9-28h9-hqcj
  • org.springframework.data:spring-data-rest-core (Maven) Vendor— Affected 3.0.0 to before 3.0.1.RELEASE Fixed in 3.0.1.RELEASE Patch available GHSA-9qf9-28h9-hqcj

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*before 1.5.9VulnerableVMware
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*2.0.0 milestone1VulnerableVMware
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*2.0.0 milestone2VulnerableVMware
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*2.0.0 milestone3VulnerableVMware
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*2.0.0 milestone4VulnerableVMware
cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*2.0.0 milestone5VulnerableVMware
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*3.0.0 m1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*3.0.0 m2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*3.0.0 m3VulnerableSpring by Pivotal
  • cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* Versions before 1.5.9 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:* Versions 2.0.0 milestone2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:* Versions 2.0.0 milestone3 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:* Versions 2.0.0 milestone4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:* Versions 2.0.0 milestone5 Vulnerable ·VMware
  • cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Spring by Pivotal
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*3.0.0 m4VulnerableSpring by Pivotal
cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*before 2.6.9VulnerableVMware
cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1VulnerableVMware
cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableVMware
cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*3.0.0 rc3VulnerableVMware
  • cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:* Versions 3.0.0 m4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* Versions before 2.6.9 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc3:*:*:*:*:*:* Versions 3.0.0 rc3 Vulnerable ·VMware

Remediation

  • Fix · GHSA-9qf9-28h9-hqcj org.springframework.data:spring-data-rest-core (Maven) Fixed in 2.6.9.RELEASE Advisory →
  • Fix · GHSA-9qf9-28h9-hqcj org.springframework.data:spring-data-rest-core (Maven) Fixed in 3.0.1.RELEASE Advisory →

Red Hat 1 advisory

  • RHSA-2018:2405 Released 2018-08-14 · Red Hat rating Critical
    Red Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update
    • Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7Fixed RHSA-2018:2405
Not affected: 1 product
  • Red Hat OpenShift Application Runtimes

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-8046
  2. 2026-10-03 Alias added: GHSA-9qf9-28h9-hqcj

References

Exploit 1

Advisory 3

Other 5

  • TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
  • TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
  • TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
  • TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
  • TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences