Lucene search

PRIOn knowledge basePRION:CVE-2022-31679

HistorySep 21, 2022 - 6:15 p.m.

Code injection

2022-09-2118:15:00

PRIOn knowledge base

www.prio-n.com

code injection

http patch

spring data rest

attacker

hidden entity attributes

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.3%

JSON

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.

CPENameOperatorVersion
spring_data_restge3.7.0
spring_data_restlt3.7.3
spring_data_restge3.6.0
spring_data_restlt3.6.7

Name	Operator	Version
spring_data_rest	ge	3.7.0
spring_data_rest	lt	3.7.3
spring_data_rest	ge	3.6.0
spring_data_rest	lt	3.6.7

References

tanzu.vmware.com/security/cve-2022-31679