← Back

CVE-2026-47849

nvd nist
Published: Aug 27, 2026Modified: Sep 2, 2026

JSON object

Loading...
7.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Exploitability: 2.8 / Impact: 4.2
Source: security@vmware.com (Secondary)

Description

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

Affected (5)

Vmware
1 product
Spring Data Rest
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Data Rest
Before 3.7.21
Spring Data Rest
From 4.0.0 to 4.4.16
Spring Data Rest
From 4.5.0 to 4.5.13
Spring Data Rest
From 5.0.0 to 5.0.6.1
Spring Data Rest
From 5.1.0 to 5.1.0.1

Related CWEs

CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.