GHSA-fv7x-v67w-cvqv

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-fv7x-v67w-cvqv/GHSA-fv7x-v67w-cvqv.json
Aliases
  • CVE-2022-31679
Published
2022-09-22T00:00:24Z
Modified
2022-09-22T23:20:21.044751Z
Details

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.

References

Affected packages

Maven / org.springframework.data:spring-data-rest-core

org.springframework.data:spring-data-rest-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.6.0
Fixed
3.6.7

Affected versions

3.*

3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6

Maven / org.springframework.data:spring-data-rest-core

org.springframework.data:spring-data-rest-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.7.0
Fixed
3.7.3

Affected versions

3.*

3.7.0
3.7.1
3.7.2