CVE-2021-22047: vmware spring_data_rest
Vulnerability summary
CVE-2021-22047 is a medium (CVSS 5.3) vulnerability in vmware spring_data_rest. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.8% of scored vulnerabilities.
Timeline
- 28-10-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.77% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Org.springframework.data1 product
- spring-data-rest-core≥ 3.4.0, < 3.4.14 | ≥ 3.5.0, < 3.5.6
Vmware1 product
- spring_data_rest≥ 3.4.0, ≤ 3.4.13 | ≥ 3.5.0, ≤ 3.5.5
2 vendors · 2 products
