Login Request a demo
Medium severity · published Oct 28, 2021
CVE-2021-22047
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Spring Data Rest · Vmware
3.4.0 through 3.4.13; 3.5.0 through 3.5.5 · source: NVD
Affected product
SD
Spring Data Rest
Vmware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22047
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22047
Vendor Advisory
https://tanzu.vmware.com/security/cve-2021-22047
More from Spring Data Rest
9.8
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of…
9.8
CVE-2017-8046
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to…
8.1
CVE-2026-41729
Spring Data REST SpEL Injection via Map Key in JSON Patch
7.5
CVE-2026-41728
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
7.5
CVE-2018-1259
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability…