CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC Questo repository è una PoC minima di riproduzione per CVE-2026-41729, pubblicata tramite l'avviso di sicurezza ufficiale di Spring. Avviso ufficiale: https://spring.io/security/cve-2026-41729/ Titolo ufficiale: Spring Data RE...

poc-cve-2018-1273

CVE-2018-1273 Versionen von Spring Data Commons vor 1.13, von 1.13 bis 1.13.10, von 2.0 bis 2.0.5 sowie ältere nicht unterstützte Versionen enthalten eine Schwachstelle im Property Binder, die durch unsachgemäße Neutralisierung spezieller Elemente verursacht wird. Ein nicht authentifizierter...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versioni precedenti alla 1.13.10, dalla 2.0 alla 2.0.5, e versioni precedenti non supportate, contengono una vulnerabilità del property binder causata da una neutralizzazione impropria di elementi speciali. Un utente malintenzionato remoto non autenticato può...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Questo è un programma Java che sfrutta la vulnerabilità Spring Break CVE-2017-8046. Questo software è scritto per avere il minor numero possibile di dipendenze esterne. DISCLAIMER Questo strumento è destinato a ingegneri della sicurezza e specialisti appsec per valutazio...

CVE-2017-8046-DEMO

Test demo di spring data rest CVE-2017-8046 per favore AGGIORNA spring data rest ORA. passaggi Avvia questa applicazione Crea un'istanza di test POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" Utilizzando l'iniezione SPEL,...

VulnerableSpringDataRest

App Spring DataRest Vulnerabile Questa è un'applicazione Spring Data REST volutamente vulnerabile per testare e dimostrare la vulnerabilità CVE-2017-8046 e le sfide del testare l'Iniezione di Comandi e l'Esecuzione Remota di Codice tramite API REST Supporta Swagger UI per l'uso con strumenti in c...

SpringBreakVulnerableApp

Applicazione vulnerabile Spring Break Questa è un'applicazione vulnerabile per testare l'exploit della vulnerabilità Spring Break CVE-2017-8046. ATTENZIONE! Questa applicazione contiene gravi vulnerabilità di sicurezza. Eseguila a tuo rischio! Si consiglia di utilizzare un ambiente isolato e con...

spring-data-rest-CVE-2017-8046

image:https://spring.io/badges/spring-data-rest/ga.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" image:https://spring.io/badges/spring-data-rest/snapshot.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" = Spring Data REST...

ROOT-APP-MAVEN-CVE-2026-41728 CVE-2026-41728 in org.springframework.data:spring-data-rest-core - Patched by Root

Root has patched CVE-2026-41728 in the org.springframework.data:spring-data-rest-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41729 CVE-2026-41729 in org.springframework.data:spring-data-rest-core - Patched by Root

Root has patched CVE-2026-41729 in the org.springframework.data:spring-data-rest-core package for Root:Maven. Multiple fixed versions available...

Improper Access Control

Spring Data REST is vulnerable to Improper Access Control. The vulnerability is due to insufficient protection of identifier @Id and version @Version properties from mutation through RFC 6902 JSON Patch requests, which allows an attacker to modify these properties and potentially alter resource...

Optimistic Locking/version Validation Bypass

Spring Data REST is vulnerable to improper handling of the persisted @Version property during HTTP PUT requests against immutable target types. The vulnerability is due to Spring Data REST failing to preserve the persisted version value of an aggregate root when processing a PUT request, which...

CVE-2026-47849

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

EUVD-2026-66837

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849

Spring Data REST fails to protect @Id and @Version properties from mutation via RFC 6902 JSON Patch requests (content type application/json-patch+json). This allows an authenticated user to alter identifier and version fields, leading to high integrity impact (CVSS 3.1: 7.1, AV:N/AC:L/PR:L/UI:N/S...

CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....