« Volver al listado

CVE-2026-47850

Estado: AnalizadaMedia (4.3)—

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Spring Data Rest

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47850",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47850",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-27T15:15:26.445066Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Data REST",
          "versions": [
            {
              "status": "affected",
              "version": "5.1.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "5.0.6"
            },
            {
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.5.12"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.4.15"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.7.20"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-27T01:17:31.997",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-47850",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier"
    }
  ],
  "lastModified": "2026-09-04T20:07:16.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2979CBFB-615C-4007-A893-19D9A7A7F0DD",
              "versionEndExcluding": "3.7.21"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FF3DB0B-638D-4960-AF30-F900D5730971",
              "versionEndExcluding": "4.4.16",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C2D2111-102B-467C-A5EE-F1A793D96800",
              "versionEndExcluding": "4.5.13",
              "versionStartIncluding": "4.5.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FF11937-7252-49E3-9003-B1F42EABC311",
              "versionEndExcluding": "5.0.6.1",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E236D1CC-BB97-41F2-A6FB-47780C1434FE",
              "versionEndExcluding": "5.1.0.1",
              "versionStartIncluding": "5.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}