CVE-2022-31679: Exposure of Sensitive Information to an Unauthorized Actor

September 21, 2022 (updated September 22, 2022)

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.

References

nvd.nist.gov/vuln/detail/CVE-2022-31679
tanzu.vmware.com/security/cve-2022-31679

Detect and mitigate CVE-2022-31679 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →