Business information leak In org.springframework.data:spring-data-rest-core
Description
Spring Data REST can expose hidden entity attributes Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 3.6.7, 3.7.3 |
Aliases
1. 2. 3. 4.
References
1. 2. 3.