| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.data:spring-data-rest-core | ≥ 3.6.0, < 3.6.7≥ 3.7.0, < 3.7.3 | 3.6.73.7.3 |
| spring data rest | ≥ 3.6.0, < 3.6.7≥ 3.7.0, < 3.7.3 | 3.6.73.7.3 |
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free