CVE-2021-22047: Exposure of Resource to Wrong Sphere

October 28, 2021 (updated November 1, 2021)

In Spring Data REST, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.

References

nvd.nist.gov/vuln/detail/CVE-2021-22047
tanzu.vmware.com/security/cve-2021-22047

Code Behaviors & Features

Detect and mitigate CVE-2021-22047 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →