CVE-2022-22980
SpEL Injection in Spring Data MongoDB
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Record
CVE-2022-22980- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-917
- Updated
- 2026-11-02
CVE List No score
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Record
CVE-2022-22980- Updated
- 2026-11-02
EUVDEUVD-2022-6169 No score
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Record
EUVD-2022-6169- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w24x-87mr-4r23
SpEL Injection in Spring Data MongoDB
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Record
GHSA-w24x-87mr-4r23- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
OSVGHSA-w24x-87mr-4r23
SpEL Injection in Spring Data MongoDB
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Record
GHSA-w24x-87mr-4r23- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
OSV No score
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Record
CVE-2022-22980- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-mongodbMaven |
3.4.0 to 3.4.0 | 3.4.1 |
org.springframework.data:spring-data-mongodbMaven |
before 3.3.5 | 3.3.5 |
org.springframework.data:spring-data-mongodbMaven |
3.4.0 up to 3.4.1 | 3.4.1 |
org.springframework.data:spring-data-mongodbMaven |
before 3.3.5, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE Show 45 moreShow less1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.10.0.RELEASE1.10.1.RELEASE1.10.10.RELEASE1.10.11.RELEASE1.10.12.RELEASE1.10.13.RELEASE1.10.14.RELEASE1.10.15.RELEASE1.10.16.RELEASE1.10.17.RELEASE1.10.18.RELEASE1.10.2.RELEASE1.10.20.RELEASE1.10.21.RELEASE1.10.22.RELEASE1.10.23.RELEASE1.10.3.RELEASE1.10.4.RELEASE1.10.5.RELEASE1.10.6.RELEASE1.10.7.RELEASE1.10.8.RELEASE1.10.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.4.RELEASE |
3.3.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Eliasdekiniweek/CVE-2022-22980 | 2026-02-18 |
| PoC in GitHub | Vulnmachines/Spring_cve-2022-22980 | 2022-07-13 |
| PoC in GitHub | jweny/cve-2022-22980 | 2022-06-22 |
| PoC in GitHub | kuron3k0/Spring-Data-Mongodb-Example | 2022-06-21 |
| PoC in GitHub | li8u99/Spring-Data-Mongodb-Demo | 2022-06-22 |
| PoC in GitHub | murataydemir/CVE-2022-22980 | 2022-06-28 |
| PoC in GitHub | trganda/CVE-2022-22980 | 2022-06-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-22980 is a critical vulnerability (CVSS 9.8) in Vmware Spring Data Mongodb, published June 22, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.8%, the 97th percentile. Fixed in org.springframework.data:spring-data-mongodb 3.4.1.
References
Left out here: 123 versions. The JSON record has them.