« Volver al listado

CVE-2026-41717

Estado: AnalizadaAlta (8.1)—

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.

Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SpEL injection en parámetro de @Query permite ejecución de código arbitrario remoto (AV:N, sin autenticación). C:H/I:H refleja acceso a datos y manipulación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentRestrict File and Directory PermissionsRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Vmware — Spring Data Mongodb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41717",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41717",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-10T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Data MongoDB",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.0.5.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.5.0",
              "lessThan": "4.5.11.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.4.0",
              "lessThan": "4.4.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.3.0",
              "lessThan": "4.3.17",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.2.0",
              "lessThan": "4.2.16",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "lessThan": "4.1.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.16",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.4.0",
              "lessThan": "3.4.20",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-10T00:16:51.683",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-41717",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-917"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
    },
    {
      "lang": "es",
      "value": "Spring Data MongoDB contiene una vulnerabilidad de inyección de expresiones SpEL (Spring Expression Language). El problema ocurre durante la vinculación de parámetros cuando un método de consulta de repositorio definido por el usuario está anotado con @Query y utiliza un marcador de posición de captura total.\n\nVersiones afectadas:\nSpring Data MongoDB 5.0.0 hasta 5.0.5; 4.5.0 hasta 4.5.11; 4.4.0 hasta 4.4.14; 4.3.0 hasta 4.3.16; 4.2.0 hasta 4.2.15; 4.1.0 hasta 4.1.14; 4.0.0 hasta 4.0.15; 3.4.0 hasta 3.4.19."
    }
  ],
  "lastModified": "2026-07-23T09:10:00.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E55F58B-81A9-4912-9573-5B452BC55E51",
              "versionEndExcluding": "3.4.20",
              "versionStartIncluding": "3.4.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEF77DA7-2F90-432C-8993-EF12D9AC4540",
              "versionEndExcluding": "4.0.16",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "445103F2-9A1F-439A-BE81-3B516C10839D",
              "versionEndExcluding": "4.1.15",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "013F48F6-7CBB-4F70-8A5B-4CF016B4DEB4",
              "versionEndExcluding": "4.2.16",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5BFEA5F-410F-441E-9DC9-34C03B566E50",
              "versionEndExcluding": "4.3.17",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0BD2306-031F-4D72-BC3E-19ACB886E73D",
              "versionEndExcluding": "4.4.15",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FCD5F74-2A0E-411F-8DB4-375486A66D1F",
              "versionEndIncluding": "4.5.11.1",
              "versionStartIncluding": "4.5.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F530EDE-94AE-42FA-A6FE-458CAC0B7EF3",
              "versionEndExcluding": "5.0.5.1",
              "versionStartIncluding": "5.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}