{"id":"CVE-2017-8046","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-8046","generatedAt":"2026-10-28T19:51:08.942Z","title":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","published":"2018-01-04T06:29:00.000Z","lastModified":"2026-06-26T18:44:15.000Z","status":"Modified","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-20"],"affected":["vmware/spring boot","pivotal software/spring data rest","vmware/spring data rest"],"epss":{"score":0.7453,"percentile":0.99495,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.53936,"percentile":0.98978},{"date":"2026-09-22","score":0.7453,"percentile":0.99475}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2018-03-15","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44289,"kind":"exploit","title":"Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution","url":"https://www.exploit-db.com/exploits/44289","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/44289.java","file":"exploits/java/webapps/44289.java","published":"2018-03-15","added":"2018-03-15","updated":"2018-03-16","author":"Antonio Francesco Sardella","type":"webapps","platform":"java","port":null,"verified":false,"codes":["CVE-2017-8046"],"tags":null,"aliases":"Spring Break","applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/m3ssap0/spring-break_cve-2017-8046"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 74.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.7453,"from":0.53936,"percentile":0.99475},"summary":"EPSS moved from 53.9% to 74.5% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.53936,"from":0.7453,"percentile":0.98978},"summary":"EPSS moved from 74.5% to 53.9% probability of exploitation in the next thirty days."}],"references":[{"url":"http://www.securityfocus.com/bid/100948","tags":["Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:2405","source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2017-8046","tags":["Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.exploit-db.com/exploits/44289/","tags":["Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/100948","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2405","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2017-8046","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44289/","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-8046","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}