Spring Data REST vulnerabilities

Spring Data REST versions 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier do not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch requests.

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Affects Spring Data REST 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier.

Spring Data REST's Querydsl integration accepts arbitrary property paths as filter keys and ignores Jackson customizations before handing them to Querydsl. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Vulnerability in Spring Data REST where the full exception cause chain is serialized into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Vulnerability in Spring Data REST involving SpEL expression injection through map-typed properties when processing JSON Patch requests. The JSON Pointer path segment used as the map key is embedded into a SpEL expression without sanitization. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Spring Data REST's JSON Patch implementation does not apply write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5.