Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spring_data_rest | Vmware | 3.6.0 (including) | 3.6.7 (excluding) |
| Spring_data_rest | Vmware | 3.7.0 (including) | 3.7.3 (excluding) |