Vulnerability · Published Sep 21, 2022 · Assigned by vmware
CVE-2022-31679
Low 3.7
In plain English
A low-severity security flaw in Spring Data REST. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.6%top 53.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-rest-core | 3.6.7 | GHSA-fv7x-v67w-cvqv |
| Maven | org.springframework.data:spring-data-rest-core | 3.7.3 | GHSA-fv7x-v67w-cvqv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Data REST | Spring Data REST Versions before 3.6.7 and 3.7.3 |
References
- https://tanzu.vmware.com/security/cve-2022-31679 x_refsource_MISC