CVE-2022-31679: Low severity VMware Spring Data REST vulnerability
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31679?
CVE-2022-31679 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-31679?
To fix CVE-2022-31679, upgrade Spring Data REST to version 3.7.3 or later, or 3.6.7 or later.
What types of applications are affected by CVE-2022-31679?
Applications that utilize Spring Data REST versions 3.6.0 to 3.6.7 and 3.7.0 to 3.7.2, along with older unsupported versions, are affected.
What impact does CVE-2022-31679 have on affected applications?
CVE-2022-31679 allows an attacker to craft HTTP requests that can expose hidden entity attributes if they understand the domain model.
What should I do if I cannot immediately upgrade to fix CVE-2022-31679?
If immediate upgrade is not possible, consider restricting HTTP PATCH access to mitigate the risk associated with CVE-2022-31679.