What is GHSA-4926-qpxg-6r3w?

GHSA-4926-qpxg-6r3w is a security advisory published by GitHub Security Advisories with Medium severity. Exposure of Resource to Wrong Sphere in Spring Data REST

Which CVE IDs does GHSA-4926-qpxg-6r3w cover?

GHSA-4926-qpxg-6r3w covers the following CVE IDs: CVE-2021-22047. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4926-qpxg-6r3w?

GHSA-4926-qpxg-6r3w has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-4926-qpxg-6r3w?

GHSA-4926-qpxg-6r3w affects 2 products, including: maven/org.springframework.data:spring-data-rest-core:\u003e= 3.4.0, \u003c= 3.4.13; maven/org.springframework.data:spring-data-rest-core:\u003e= 3.5.0, \u003c= 3.5.5.

GHSA-4926-qpxg-6r3wMediumCVSS 5.3

Exposure of Resource to Wrong Sphere in Spring Data REST

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-22047 →

📋 Description

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.

🎯 Affected products2

maven/org.springframework.data:spring-data-rest-core:>= 3.4.0, <= 3.4.13
maven/org.springframework.data:spring-data-rest-core:>= 3.5.0, <= 3.5.5

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-22047
https://tanzu.vmware.com/security/cve-2021-22047
https://github.com/advisories/GHSA-4926-qpxg-6r3w