Lucene search
Veracode Vulnerability DatabaseVERACODE:37252HistorySep 23, 2022 - 9:23 a.m.
Information Disclosure
2022-09-2309:23:35
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
20
vulnerability
information disclosure
spring-data-rest-webmvc
json patch
entity attributes
http requests
EPSS
0.001
Percentile
42.1%
spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests.
References
github.com/advisories/GHSA-fv7x-v67w-cvqv
github.com/spring-projects/spring-data-rest/commit/2ad081f75b4baabfbc139f0dc2b75c54889b4053
github.com/spring-projects/spring-data-rest/commit/bf37590b25a0c066f67547b39fb4d7294e2c7cb7
github.com/spring-projects/spring-data-rest/issues/2177
tanzu.vmware.com/security/cve-2022-31679
Related
github
github
Spring Data REST can expose hidden entity attributes
2022-09-22 00:00:24
cvelist
cvelist
CVE-2022-31679
2022-09-21 17:42:42
nvd
nvd
CVE-2022-31679
2022-09-21 18:15:10
spring
spring
This Week in Spring - September 20th, 2022
2022-09-20 07:00:00
Spring Data REST Vulnerability (CVE-2022-31679)
2022-09-19 15:49:00
osv
osv
Spring Data REST can expose hidden entity attributes
2022-09-22 00:00:24
prion
prion
Code injection
2022-09-21 18:15:00
cve
cve
CVE-2022-31679
2022-09-21 18:15:10
