spring-data-rest-CVE-2017-8046

image:https://spring.io/badges/spring-data-rest/ga.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" image:https://spring.io/badges/spring-data-rest/snapshot.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" = Spring Data REST Цель...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, 1.13부터 1.13.10, 2.0부터 2.0.5까지의 버전 및 지원이 중단된 구버전에서는 특수 요소의 부적절한 중립화로 인한 속성 바인더 취약점이 존재합니다. 인증되지 않은 원격 악의적인 사용자또는 공격자는 Spring Data REST 기반 HTTP 리소스 또는 Spring Data의 프로젝션 기반 요청 페이로드 바인딩에 대해 특별히 조작된 요청 파라미터를 제공하여 원격 코드 실행 공격을 유발할 수 있습니다. 더 많은 정보는 여기에서 확인할 수 있습니다. 실행 ...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versioni precedenti alla 1.13 fino alla 1.13.10, dalla 2.0 alla 2.0.5 e versioni meno recenti non supportate, contengono una vulnerabilità nel binder delle proprietà causata da una neutralizzazione impropria di elementi speciali. Un utente malintenzionato remoto...

CVE-2017-8046-DEMO

Test demo di spring data rest CVE-2017-8046 per favore AGGIORNA spring data rest ORA. passaggi Avvia questa applicazione Crea un'istanza di test root@kitploit: POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" Utilizzando...

CVE-2026-47849

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

EUVD-2026-66837

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849

Spring Data REST fails to protect @Id and @Version properties from mutation via RFC 6902 JSON Patch requests (content type application/json-patch+json). This allows an authenticated user to alter identifier and version fields, leading to high integrity impact (CVSS 3.1: 7.1, AV:N/AC:L/PR:L/UI:N/S...

EUVD-2026-66820

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-41730

CVE-2026-41730...

CVE-2026-47850

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted @Version property of an aggregate root when handling an HTTP PUT against an immutable target type, allowing mutation of the version field. The issue is rated MEDIUM (CVSS 4.3) with a low integrity impact. Affected versions include 5.1.0 , 5.0.0–5.0...

CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC Questo repository è una PoC minima di riproduzione per CVE-2026-41729, pubblicata tramite l'avviso di sicurezza ufficiale di Spring. Avviso ufficiale: https://spring.io/security/cve-2026-41729/ Titolo ufficiale: Spring Data RE...

PT-2026-82348

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Questo è un programma Java che sfrutta la vulnerabilità Spring Break CVE-2017-8046. Questo software è scritto per avere il minor numero possibile di dipendenze esterne. DISCLAIMER Questo strumento è destinato a ingegneri della sicurezza e specialisti appsec per valutazio...

SpringBreakVulnerableApp

Aplicação Vulnerável Spring Break Esta é uma aplicação vulnerável para testar o exploit para a vulnerabilidade Spring Break CVE-2017-8046. AVISO! Esta aplicação contém sérias vulnerabilidades de segurança. Execute-a por sua conta e risco! Recomenda-se usar um ambiente com backup e isolado como um...

VulnerableSpringDataRest

Verwundbare Spring DataRest App Dies ist eine absichtlich verwundbare Spring Data REST-Anwendung, um die CVE-2017-8046-Schwachstelle zu testen und zu demonstrieren sowie die Herausforderungen beim Testen von Befehlsinjektion und Remote-Code-Ausführung über REST-APIs Es unterstützt Swagger UI zur...

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT...