{"action":"Upgrade org.springframework.data:spring-data-rest-core to 2.6.9.RELEASE (2.x) or 3.0.1.RELEASE (3.x) or later.","affected":[{"fixed":"2.6.9.RELEASE","introduced":"0"},{"fixed":"3.0.1.RELEASE","introduced":"3.0.0"}],"component":"org.springframework.data:spring-data-rest-core","cve_ids":["CVE-2017-8046"],"ecosystem":"Maven","epss":0.7453,"exploited":false,"fixed_versions":["2.6.9.RELEASE","3.0.1.RELEASE"],"ghsa_id":"GHSA-9qf9-28h9-hqcj","id":"tcs_01M5N8QHVTP5P983PZV8HNM007","modified_at":"2023-11-08T03:59:27.559276Z","published_at":"2022-05-13T01:02:43Z","references":["https://osv.dev/vulnerability/GHSA-9qf9-28h9-hqcj","https://nvd.nist.gov/vuln/detail/CVE-2017-8046","https://github.com/spring-projects/spring-data-rest/issues/1487","https://github.com/spring-projects/spring-data-rest/issues/1520","https://access.redhat.com/errata/RHSA-2018:2405","https://bugzilla.redhat.com/show_bug.cgi?id=1553024","https://github.com/spring-projects/spring-data-rest","https://jira.spring.io/browse/DATAREST-1127?redirect=false","https://pivotal.io/security/cve-2017-8046"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9qf9-28h9-hqcj","url":"https://osv.dev/vulnerability/GHSA-9qf9-28h9-hqcj"}],"summary":"Remote code execution in PATCH requests in Spring Data REST"}