description: A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
problem types: Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods
affected:
{
product: Spring Data MongoDB
vendor: n/a
versions:
status: affected, version: 3.4.0, 3.3.0 to 3.3.4 and Older
}