Description
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- Spring / Spring Data REST5.1.0 – 5.1.0
- Spring / Spring Data REST5.0.0 – 5.0.6
- Spring / Spring Data REST4.5.0 – 4.5.12
- Spring / Spring Data REST4.0.0 – 4.4.15
- Spring / Spring Data REST0 – 3.7.20
References
Updated 46m ago · 8 sources