CVE-2017-8046
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring...
- Published
- Jan 4, 2018
- Updated
- Aug 5, 2024
- Assigning CNA
- dell
- Evidence observed
- Mar 15, 2018
Primary CVSS
nvd · CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.5%
- Model date
- Oct 12, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Sources
- Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code ExecutionTemplate
http/cves/2017/CVE-2017-8046.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
- oob: interactsh_reference($.template_text)
spring/CVE-2017-8046
Spring Data REST Remote Code Execution (CVE-2017-8046)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/spring-rest-data:2.6.6(spring/CVE-2017-8046/docker-compose.yml:services.spring.image)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.