CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.

CVSS v3.0 3.7 LOW

3.7^/10

CVSS v3.0 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://tanzu.vmware.com/security/cve-2022-31679	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_data_rest::::::::
	cpe:2.3:a:vmware:spring_data_rest::::::::

Information

Published : 2022-09-21 11:15

Updated : 2022-09-22 12:42

NVD link : CVE-2022-31679

Mitre link : CVE-2022-31679

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

vmware

spring_data_rest

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://tanzu.vmware.com/security/cve-2022-31679", "name": "https://tanzu.vmware.com/security/cve-2022-31679", "tags": ["Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-31679", "ASSIGNER": "security@vmware.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}}, "publishedDate": "2022-09-21T18:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.7.3", "versionStartIncluding": "3.7.0"}, {"cpe23Uri": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.6.7", "versionStartIncluding": "3.6.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-09-22T19:42Z"}

3.7 /10