CVE-2017-8046
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Risk Assessment
An attacker can remotely execute arbitrary Java code on the server, leading to full compromise of the application and potentially the entire system.
Recommendation
Immediately update Spring Data REST to version 2.6.9 (Ingalls SR9) or 3.0.1 (Kay SR1) and Spring Boot to version 1.5.9 or later (2.0 M6 is insufficient).
Original NVD description (English source)
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.