GHSA-fv7x-v67w-cvqv
Spring Data REST can expose hidden entity attributes
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-rest-core | >= 3.6.0, < 3.6.7 | 3.6.7 |
| Maven | org.springframework.data:spring-data-rest-core | >= 3.7.0, < 3.7.3 | 3.7.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-31679
- https://github.com/spring-projects/spring-data-rest/commit/2ad081f75b4baabfbc139f0dc2b75c54889b4053
- https://github.com/spring-projects/spring-data-rest/commit/bf37590b25a0c066f67547b39fb4d7294e2c7cb7
- https://github.com/spring-projects/spring-data-rest
- https://tanzu.vmware.com/security/cve-2022-31679