About vulnerability

SVG ImageDescription

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB.

SVG ImageAffected Spring Products and Versions

Spring AI:

• 1.0.0 - 1.0.x
• 1.1.0 - 1.1.x

Affected components:

• spring-ai-elasticsearch-store
• spring-ai-opensearch-store
• spring-ai-gemfire-store

SVG ImageMitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

SVG ImageCredit

The issue was reported responsibly by Nitro Cao (@NitroCao) from Alibaba Cloud.

SVG ImageReferences

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L&version=3.1

SVG ImageDescription

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB.

SVG ImageAffected Spring Products and Versions

Spring AI:

• 1.0.0 - 1.0.x
• 1.1.0 - 1.1.x

Affected components:

• spring-ai-elasticsearch-store
• spring-ai-opensearch-store
• spring-ai-gemfire-store

SVG ImageMitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

SVG ImageCredit

The issue was reported responsibly by Nitro Cao (@NitroCao) from Alibaba Cloud.

SVG ImageReferences

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L&version=3.1