CVE-2022-31679

Exposure of Sensitive Information to an Unauthorized Actor in maven/org.springframework.data/spring-data-rest-core

Identifiers

CVE-2022-31679

Package Slug

maven/org.springframework.data/spring-data-rest-core

Vulnerability

Exposure of Sensitive Information to an Unauthorized Actor

Description

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.

Affected Versions

All versions starting from 3.6.0 before 3.6.7, all versions starting from 3.7.0 before 3.7.3

Solution

Upgrade to versions 3.6.7, 3.7.3 or above.

Last Modified

2022-09-23

source