Read the docs
TI-2022-07156 Aliases CVE-2022-22980GHSA-w24x-87mr-4r23

Expression language injection in Spring Data MongoDB

Priority MEDIUM 59CWE-917Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-917.

Summary

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Why it matters now

EPSS 0.17836 97th percentileScored 2026-11-07
Fix Partial org.springframework.data:spring-data-mongodb (Maven): 3.4.1, 3.3.5Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring Data MongoDB3.4.0, 3.3.0 to 3.3.4 and Older—No fix listedCNA
—org.springframework.data:spring-data-mongodb (Maven)3.4.0 to before 3.4.13.4.1Patch availableGHSA-w24x-87mr-4r23
—org.springframework.data:spring-data-mongodb (Maven)before 3.3.53.3.5Patch availableGHSA-w24x-87mr-4r23
  • Spring Data MongoDB Vendor— Affected 3.4.0, 3.3.0 to 3.3.4 and Older Fixed in — No fix listed CNA
  • org.springframework.data:spring-data-mongodb (Maven) Vendor— Affected 3.4.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-w24x-87mr-4r23
  • org.springframework.data:spring-data-mongodb (Maven) Vendor— Affected before 3.3.5 Fixed in 3.3.5 Patch available GHSA-w24x-87mr-4r23

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*up to 3.3.4VulnerableVMware
cpe:2.3:a:vmware:spring_data_mongodb:3.4.0:*:*:*:*:*:*:*3.4.0VulnerableVMware
  • cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:* Versions up to 3.3.4 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_data_mongodb:3.4.0:*:*:*:*:*:*:* Versions 3.4.0 Vulnerable ·VMware

Remediation

  • Fix · GHSA-w24x-87mr-4r23 org.springframework.data:spring-data-mongodb (Maven) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-w24x-87mr-4r23 org.springframework.data:spring-data-mongodb (Maven) Fixed in 3.3.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22980
  2. 2026-10-03 Alias added: GHSA-w24x-87mr-4r23

References

Advisory 2

  • TI-2026-30233 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding CVSS 3.1HIGH 8.1
  • TI-2026-30213 Spring Data MongoDB Bind Parameter Literal Quoting Breakout CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences