Description
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.
Spring Data REST 5.1.0
Spring Data REST 5.0.0 - 5.0.6
Spring Data REST 4.5.0 - 4.5.12
Spring Data REST 4.0.0 - 4.4.15
Spring Data REST 3.7.20 and earlier
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Data REST | 5.1.0, 5.0.0 – ≤ 5.0.6, 4.5.0 – ≤ 4.5.12, 4.0.0 – ≤ 4.4.15, ≤ 3.7.20 | — |