CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Design/Logic Flaw

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

CVE-2021-22047 affects Spring Data REST: HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are exposed under URIs that may be accessible without authorization, depending on Spring Security configuration.impact is describe...

br.com.anteros:anteros-keycloak (1.0.0), com.github.paulcwarren:content-rest-spring-boot-starter (>=v1.2.0, <=1.2.4) +33 more potentially affected by CVE-2021-22047 via org.springframework.data:spring-data-rest-core (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =3.4.0, =v1.2.0, =v1.2.0, =v1.2.0, =1.5.0, =1.5.0, =1.5.0, =0.0.2.1, =0.2.2, =0.0.1, =0.2.5, =0.9.0, =0.9.1 and more Source cves: CVE-2021-22047 Source advisory: MEND:CVE-2021-22047...

be.personify.iam:personify-api (>=1.2.6.release, <=1.3.1.release), be.personify.iam:personify-frontend (>=1.2.6.release, <=1.3.0.release) +50 more potentially affected by CVE-2021-22047 via org.springframework.data:spring-data-rest-core (>=3.5.0, <=3.5.5)

org.springframework.data:spring-data-rest-core MAVEN version =3.5.0, =1.2.6.release, =1.2.6.release, =1.2.5.release, =2.1.0, =2.1.0, =2.1.0, =5.3.0, =2.1.0, =1.1.0, =2.5.0, =2.5.1 and more Source cves: CVE-2021-22047 Source advisory: MEND:CVE-2021-22047...

PT-2021-14846

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.4.0 through 3.4.13 Spring Data REST versions 3.5.0 through 3.5.5 Spring Data REST older unsupported versions Description The issue affects HTTP resources implemented by custom controllers using a configured base API...

CVE-2021-22047: Exposure of Sensitive Information to an Unauthorized Actor

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

VMware Spring Security security vulnerabilities

VMware Spring Security is a set of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in Spring Data REST that stems from the additional disclosure of HTTP resources under the uri for custom controller...

Potential Security Bypass for customized Spring Data REST Resource

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Exploit for Code Injection in Pivotal_Software Spring_Data_Commons

Based on the provided code and metadata, here is a description of the repository and its contents: Repository: This repository appears to be a Maven wrapper for the Apache Maven project, specifically version 3.5.3. The repository contains metadata and configuration files for the Maven wrapper,...

com.smb-tec.neo4j:neo4j-community (2.0.2), org.neo4j.app:neo4j-server (2.0.2) +11 more potentially affected by CVE-2021-34371 via org.neo4j:neo4j (2.0.2)

org.neo4j:neo4j MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.smb-tec.neo4j:neo4j-community 2.0.2 - org.neo4j.app:neo4j-server 2.0.2 - org.neo4j.app:neo4j-server-advanced 2.0.2 -...

org.springframework.data:spring-data-neo4j-rest (1.0.0.release) potentially affected by CVE-2021-34371 via org.neo4j:neo4j (1.3)

org.neo4j:neo4j MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-rest 1.0.0.release Source cves: CVE-2021-34371 Source advisory: OSV:GHSA-PC4W-8V5J-29W9...

org.springframework.data:spring-data-neo4j-rest (1.1.0.release) potentially affected by CVE-2021-34371 via org.neo4j:neo4j (1.4.1)

org.neo4j:neo4j MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-rest 1.1.0.release Source cves: CVE-2021-34371 Source advisory: OSV:GHSA-PC4W-8V5J-29W...

org.springframework.data:spring-data-neo4j-aspects (2.0.0.release), org.springframework.data:spring-data-neo4j-cross-store (2.0.0.release) potentially affected by CVE-2021-34371 via org.neo4j:neo4j (1.6.m02)

org.neo4j:neo4j MAVEN version 1.6.m02 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-aspects 2.0.0.release - org.springframework.data:spring-data-neo4j-cross-store...

Exploit for Code Injection in Pivotal_Software Spring_Data_Commons

Zhengjim - 漏洞复现 搭漏洞环境是一个繁琐的事情，这里记录下自己学习搭各种环境的记录。部分利用Vulhub一个面向大众的开源漏洞靶场，来搭建漏洞环境，比较方便。（主要懒！） 漏洞 1. S2-057命令执行漏洞 2. ghostscript命令执行漏洞 3. weblogic反序列化漏洞CVE-2018-2628 4. Elasticsearch-Kibana本地包含漏洞CVE-2018-17246 5. ThinkPHP5.x版本命令执行漏洞 6. WordPressRESTAPI内容注入漏洞 7. Git漏洞允许任意代码执行CVE-2018-17456 8. Apache...

Important: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

A minor version update from 7.6 to 7.7 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...