{"id":"CVE-2022-22980","aliases":["EUVD-2022-6169","GHSA-w24x-87mr-4r23"],"status":"published","title":"SpEL Injection in Spring Data MongoDB","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.17836,"percentile":0.97194,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-917"],"published":"2022-06-22T13:56:00Z","modified":"2026-10-28T02:30:26Z","exploits":[{"source":"pocgithub","id":"Eliasdekiniweek/CVE-2022-22980","title":"Eliasdekiniweek/CVE-2022-22980","date":"2026-02-18","url":"https://github.com/Eliasdekiniweek/CVE-2022-22980"},{"source":"pocgithub","id":"Vulnmachines/Spring_cve-2022-22980","title":"Vulnmachines/Spring_cve-2022-22980","date":"2022-07-13","url":"https://github.com/Vulnmachines/Spring_cve-2022-22980"},{"source":"pocgithub","id":"jweny/cve-2022-22980","title":"jweny/cve-2022-22980","date":"2022-06-22","url":"https://github.com/jweny/cve-2022-22980"},{"source":"pocgithub","id":"kuron3k0/Spring-Data-Mongodb-Example","title":"kuron3k0/Spring-Data-Mongodb-Example","date":"2022-06-21","url":"https://github.com/kuron3k0/Spring-Data-Mongodb-Example"},{"source":"pocgithub","id":"li8u99/Spring-Data-Mongodb-Demo","title":"li8u99/Spring-Data-Mongodb-Demo","date":"2022-06-22","url":"https://github.com/li8u99/Spring-Data-Mongodb-Demo"},{"source":"pocgithub","id":"murataydemir/CVE-2022-22980","title":"murataydemir/CVE-2022-22980","date":"2022-06-28","url":"https://github.com/murataydemir/CVE-2022-22980"},{"source":"pocgithub","id":"trganda/CVE-2022-22980","title":"trganda/CVE-2022-22980","date":"2022-06-21","url":"https://github.com/trganda/CVE-2022-22980"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.data:spring-data-mongodb","fixed_in":["3.4.1","3.3.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.0"},{"fixed":"3.4.1"}]}],"versions":["3.4.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.1"}]}],"versions":["3.4.0"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}],"versions":["1.0.0.RELEASE","1.0.1.RELEASE","1.0.2.RELEASE","1.0.3.RELEASE","1.0.4.RELEASE","1.1.0.RELEASE","1.1.1.RELEASE","1.1.2.RELEASE","1.10.0.RELEASE","1.10.1.RELEASE","1.10.10.RELEASE","1.10.11.RELEASE","1.10.12.RELEASE","1.10.13.RELEASE","1.10.14.RELEASE","1.10.15.RELEASE","1.10.16.RELEASE","1.10.17.RELEASE","1.10.18.RELEASE","1.10.2.RELEASE","1.10.20.RELEASE","1.10.21.RELEASE","1.10.22.RELEASE","1.10.23.RELEASE","1.10.3.RELEASE","1.10.4.RELEASE","1.10.5.RELEASE","1.10.6.RELEASE","1.10.7.RELEASE","1.10.8.RELEASE","1.10.9.RELEASE","1.2.0.RELEASE","1.2.1.RELEASE","1.2.2.RELEASE","1.2.3.RELEASE","1.2.4.RELEASE","1.3.0.RELEASE","1.3.1.RELEASE","1.3.2.RELEASE","1.3.3.RELEASE","1.3.4.RELEASE","1.3.5.RELEASE","1.4.0.RELEASE","1.4.1.RELEASE","1.4.2.RELEASE","1.4.3.RELEASE","1.5.0.RELEASE","1.5.1.RELEASE","1.5.2.RELEASE","1.5.4.RELEASE","1.5.5.RELEASE","1.5.6.RELEASE","1.6.0.RELEASE","1.6.1.RELEASE","1.6.2.RELEASE","1.6.3.RELEASE","1.6.4.RELEASE","1.7.0.RELEASE","1.7.1.RELEASE","1.7.2.RELEASE","1.8.0.RELEASE","1.8.1.RELEASE","1.8.2.RELEASE","1.8.4.RELEASE","1.8.5.RELEASE","1.8.6.RELEASE","1.9.0.RELEASE","1.9.1.RELEASE","1.9.10.RELEASE","1.9.11.RELEASE","1.9.2.RELEASE","1.9.3.RELEASE","1.9.4.RELEASE","1.9.5.RELEASE","1.9.6.RELEASE","1.9.7.RELEASE","1.9.8.RELEASE","1.9.9.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.10.RELEASE","2.0.11.RELEASE","2.0.12.RELEASE","2.0.13.RELEASE","2.0.14.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","2.0.9.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.10.RELEASE","2.1.11.RELEASE","2.1.12.RELEASE","2.1.13.RELEASE","2.1.14.RELEASE","2.1.15.RELEASE","2.1.16.RELEASE","2.1.17.RELEASE","2.1.18.RELEASE","2.1.19.RELEASE","2.1.2.RELEASE","2.1.20.RELEASE","2.1.21.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.1.7.RELEASE","2.1.8.RELEASE","2.1.9.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.10.RELEASE","2.2.11.RELEASE","2.2.12.RELEASE","2.2.13.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.2.5.RELEASE","2.2.6.RELEASE","2.2.7.RELEASE","2.2.8.RELEASE","2.2.9.RELEASE","3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.0.9.RELEASE","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4"]}],"products":[{"vendor":"vmware","product":"spring_data_mongodb"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2022-22980","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22980","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w24x-87mr-4r23"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22980.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-22980","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","status":"published","published":"2022-06-22T13:56:00Z","modified":"2024-08-03T03:28:42.62Z","updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-6169","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","status":"published","published":"2022-06-22T13:56:00Z","modified":"2024-08-03T03:28:42Z","updated_at":"2026-11-03T03:25:51.741657Z"}],"ghsa":[{"id":"GHSA-w24x-87mr-4r23","title":"SpEL Injection in Spring Data MongoDB","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","status":"published","published":"2022-06-24T00:00:30Z","modified":"2023-01-27T05:05:05Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T14:36:21.8171Z"}],"nvd":[{"id":"CVE-2022-22980","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","status":"published","published":"2022-06-23T17:15:12.12Z","modified":"2026-06-17T04:29:17.273Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"GHSA-w24x-87mr-4r23","title":"SpEL Injection in Spring Data MongoDB","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","status":"published","published":"2022-06-24T00:00:30Z","modified":"2023-11-08T04:08:15.60984Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"CVE-2022-22980","description":"A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.","status":"published","published":"2022-06-22T13:56:00Z","modified":"2026-10-28T02:30:26.819751518Z","updated_at":"2026-11-02T15:44:24.061177Z"}]}}