Description
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None
Affected products
- Spring / Spring Data REST5.1.0 – 5.1.0
- Spring / Spring Data REST5.0.0 – 5.0.6
- Spring / Spring Data REST4.5.0 – 4.5.12
- Spring / Spring Data REST4.0.0 – 4.4.15
- Spring / Spring Data REST0 – 3.7.20
References
Updated 38m ago · 8 sources