CVE-2019-3797CWE-89

Additional information exposure with Spring Data JPA derived queries

Low · published May 6, 2019

CVSS v3.0
3.5
EPSS
1%
Percentile
65.0
In the wild
Unconfirmed
What it is

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

The record
Technical detail
CVSS v3.0
3.5 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01087 · 65.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2019-05-06T15:21Z
EPSS history
Timeline
  • 06 MAY 15:21Z
    Additional information exposure with Spring Data JPA derived queries
    cvelistv5