GitHub Advisoryadvisory · Maven

GHSA-4926-qpxg-6r3w Exposure of Resource to Wrong Sphere in Spring Data REST

MEDIUM Published 2022-05-24 Modified 2022-06-22 Official page ↗
Aliases
CVE-2021-22047
Ecosystem
Maven
Packages
org.springframework.data:spring-data-rest-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-668
Reviewed
2022-06-22

Affected packages

• Maven org.springframework.data:spring-data-rest-core: >= 3.4.0, < 3.4.14 → fixed in 3.4.14 • Maven org.springframework.data:spring-data-rest-core: >= 3.5.0, < 3.5.6 → fixed in 3.5.6

Description

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.

Related

Alias · CVE (1)

  • CVE-2021-22047 In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom… vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References