CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2021-22047
Medium (5.3) in vmware spring data rest. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.springframework.data:spring-data-rest-core 3.4.14, 3.5.6.
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-668, CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:spring_data_rest
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4926-qpxg-6r3w | Maven | org.springframework.data:spring-data-rest-core | >=3.4.0 <3.4.14 | 3.4.14 |
| GHSA-4926-qpxg-6r3w | Maven | org.springframework.data:spring-data-rest-core | >=3.5.0 <3.5.6 | 3.5.6 |