CVE-2017-8046

Name: CVE-2017-8046
Creator: NVD / NIST
Published: 2018-01-04T06:29:00.307+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 72.78%

Last modified Jun 26, 2026

CVE-2017-8046 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.. EPSS estimates a 72.78% chance of exploitation in the next 30 days.

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Metrics

CVSS 3.0

9.8/10

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

72.78%

99.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions	Update
Vmware	Spring Boot	< 1.5.9	—
Vmware	Spring Boot	2.0.0	Milestone1
Pivotal Software	Spring Data Rest	3.0.0	—
Vmware	Spring Data Rest	< 2.6.9	—
Vmware	Spring Data Rest	3.0.0	Rc1

References

http://www.securityfocus.com/bid/100948Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2405
https://pivotal.io/security/cve-2017-8046Vendor Advisory
https://www.exploit-db.com/exploits/44289/Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/100948Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2405
https://pivotal.io/security/cve-2017-8046Vendor Advisory
https://www.exploit-db.com/exploits/44289/Third Party Advisory, VDB Entry

Timeline

Published: Jan 4, 2018
Last Modified: Jun 26, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-8046?

How severe is CVE-2017-8046?

CVE-2017-8046 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 72.78% probability of exploitation in the next 30 days.

How do I fix CVE-2017-8046?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-8046?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST