Information Disclosure

spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...

Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

GHSA-FV7X-V67W-CVQV Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

app.commerce-io:spring-boot-starter-data-search-jpa (1.3.0), be.personify.iam:personify-api (>=1.3.2.release, <=1.4.4.release) +37 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.6.0, <=3.6.6)

org.springframework.data:spring-data-rest-core MAVEN version =3.6.0, =1.3.2.release, =1.3.1.release, =1.3.1.release, =1.2.6.release, =1.2.7, =1.2.7, =1.2.7, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: OSV:GHSA-FV7X-V67W-CVQV...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

Code injection

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: MEND:CVE-2022-31679...

CVE-2022-31679

CVE-2022-31679 affects VMware Spring Data REST. The issue allows an attacker who knows the domain model to craft HTTP PATCH requests that expose hidden entity attributes. Affected versions include Spring Data REST 3.5.5 and older, 3.6.0–3.6.6, and 3.7.0–3.7.2. The central root cause is improper h...

app.commerce-io:spring-boot-starter-data-search-jpa (1.3.0), be.personify.iam:personify-api (>=1.3.2.release, <=1.4.4.release) +37 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.6.0, <=3.6.6)

org.springframework.data:spring-data-rest-core MAVEN version =3.6.0, =1.3.2.release, =1.3.1.release, =1.3.1.release, =1.2.6.release, =1.2.7, =1.2.7, =1.2.7, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-31679 Source advisory: MEND:CVE-2022-31679...

PT-2022-20886 · Spring · Spring Data Rest

Name of the Vulnerable Software and Affected Versions: Spring Data REST versions 3.5.5 and earlier Spring Data REST versions 3.6.0 through 3.6.6 Spring Data REST versions 3.7.0 through 3.7.2 Description: The issue allows attackers to expose hidden entity attributes by crafting HTTP requests, if...

VMware Spring Data REST security vulnerabilities

VMware Spring Data REST is a data interface from VMware, Inc. It is used to build on top of the Spring Data repository, analyze an application's domain model, and expose hypermedia-driven HTTP resources for aggregations contained in the model. A security vulnerability exists in VMware Spring Data...

CVE-2022-31679: Undefined Security Weakness

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

Spring Data REST Vulnerability (CVE-2022-31679)

Updates - 09-19 Vulnerability announced here and Spring Data REST 3.6.7 and 3.7.3 released - 09-19 Blog post updated to refer to the CVE report published The Spring Data 2021.1.7 and 2021.2.3 releases shipped on September 19th contained releases for Spring Data REST 3.6.7 and 3.7.3 which include...

Potential Unintended Data Exposure for Resource Exposed by Spring Data REST

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...