# CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

- Page: https://www.vulneraibility.com/cve/CVE-2017-8046
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 74.53% (percentile 99.5)
- Public exploit code: 1 on Exploit-DB · 10 GitHub proofs of concept · 1 Nuclei template (first 2017-11-08)
- Published: 2018-01-04

## Affected versions

- Pivotal Pivotal Spring Data REST and Spring Boot: affected Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://pivotal.io/security/cve-2017-8046
- [advisory] https://access.redhat.com/errata/RHSA-2018:2405
- [other] http://www.securityfocus.com/bid/100948
- [exploit] https://www.exploit-db.com/exploits/44289/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.