CVE-2019-11343

Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java

published March 12, 2020

CVSS
—
EPSS
2%
Percentile
78.1
In the wild
Unconfirmed
What it is

⚠️ A quirk in the LIKE operator could trip up your queries in Torpedo Query versions before 2.5.3! Imagine a waiter misinterpreting your order because they can’t differentiate between ‘like’ and ‘not like’ — you might end up with something totally different than what you wanted! This confusion could lead to unexpected results in your database queries, potentially exposing sensitive information or allowing unauthorized data access. While it may not be exploited widely, the implications could be frustratingly sneaky if left unaddressed!

Put simply

Imagine a waiter misinterpreting your order because they can’t differentiate between ‘like’ and ‘not like’ — you might end up with something totally different than what you wanted! In Torpedo Query versions prior to 2.5.3, the LIKE operator is mishandled within several Java files, which can lead to incorrect query behavior and potentially unintended data exposure.

What to do

This confusion could lead to unexpected results in your database queries, potentially exposing sensitive information or allowing unauthorized data access. While it may not be exploited widely, the implications could be frustratingly sneaky if left unaddressed! Upgrade to Torpedo Query version 2.5.3 or later to resolve this mishandling of the LIKE operator. Besides upgrading, it’s also a good idea to review your query logic to ensure it meets your expectations! You've got this! Just patch it up, and your queries will be as solid as a rock! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01780 · 78.1th percentile
Published
2020-03-12T20:53Z
EPSS history
Timeline
  • 12 MAR 20:53Z
    Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java
    cvelistv5