Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn morePotential Unintended Data Exposure for Resource Exposed by Spring Data REST
Description
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Workarounds: If the resources exposed by Spring Data REST do not need to support HTTP PATCH requests, you can disable that support as described here. Applications that have generally disabled HTTP PATCH support, either through the corresponding configuration of Spring Data REST, Spring Boot or through their runtime infrastructure, are not affected, either.
Affected Spring Products and Versions
Spring Data REST:
- 3.7.0 - 3.7.2
- 3.6.6 and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 3.7.3 | OSS |
| 3.6.7 | OSS |
No further mitigation steps are necessary.
Credit
This vulnerability was initially discovered and responsibly reported by 白帽酱 @burpheart.
History
- 2022-09-19: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all