Vulnerability Details CVE-2022-31679
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 45.4%
CVSS Severity
CVSS v3 Score 3.7
References
Products affected by CVE-2022-31679
-
cpe:2.3:a:vmware:spring_data_rest:3.6.0
-
cpe:2.3:a:vmware:spring_data_rest:3.6.6
-
cpe:2.3:a:vmware:spring_data_rest:3.7.0
-
cpe:2.3:a:vmware:spring_data_rest:3.7.2