CVE-2021-22047
published 2021-10-28CVE-2021-22047: In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.75%
50.6th percentile
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| collectiveidea | audited | >= 4.0.0 < 5.3.3 | 5.3.3 |
| vmware | spring_data_rest | — | — |
| vmware | spring_data_rest | 3.4.0 – 3.4.13 | — |
| vmware | spring_data_rest | 3.5.0 – 3.5.5 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Race Condition leading to logging errors
ghsa·2023-05-01
CVE-2024-22047 [LOW] Race Condition leading to logging errors
Race Condition leading to logging errors
In certain setups with threaded web servers, Audited's use of `Thread.current` can incorrectly attributed audits to the wrong user.
Fixed in 5.3.3.
In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.
- The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601
- So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669
- And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671
GHSA
Exposure of Resource to Wrong Sphere in Spring Data REST
ghsa·2022-05-24
CVE-2021-22047 [MEDIUM] CWE-668 Exposure of Resource to Wrong Sphere in Spring Data REST
Exposure of Resource to Wrong Sphere in Spring Data REST
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
OSV
Exposure of Resource to Wrong Sphere in Spring Data REST
osv·2022-05-24
CVE-2021-22047 [MEDIUM] Exposure of Resource to Wrong Sphere in Spring Data REST
Exposure of Resource to Wrong Sphere in Spring Data REST
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-10-28
Published