CVE-2022-31679

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31679
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31679.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-31679
Aliases
Published
2022-09-21T17:42:42Z
Modified
2026-07-15T01:49:11.460472636Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31679.json",
    "cna_assigner": "vmware"
}
References

Affected packages

Git / github.com/spring-projects/spring-data-rest

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-data-rest
Events
Introduced
e31c9d49bf277d2055c0f6a8f92cc4785aba5884
Fixed
5cb03bfcf0f610e439ce99fa3a6fc8686a98bb48
Introduced
67f1a9850d30bee53f356d3926a47698a5f34eeb
Fixed
984e1ffc005f2eb6fe2c743ecbeaeb77979b724e
Database specific 
{
    "cpe": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.7"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "3.7.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

3.*
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.7.0
3.7.1
3.7.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31679.json"