CVE-2022-22980: Spring Data MongoDB SpEL Expression injection vulnerability

[balajim1]

Hi, 

Is any of Qliks products affected by the security issue called Spring Data MongoDB SpEL Expression injection vulnerability(CVE-2022-22980)? 

If so, what products and how to mitigate? 

Regards,

Balaji

[Albert_Candelario]

Hello @balajim1 ,

Thanks for posting.

Have you seen any reference on Qlik products to Spring Data MongoDB?

I cannot recall any of our products using such application and if you have a products that uses it you need to upgrade to:

• Spring Data MongoDB
  • 3.4.1+
  • 3.3.5+

Reference:  CVE-2022-22980 | Security | VMware Tanzu

Cheers,

Albert