CVE-2019-3802CWE-155

Additional information exposure with Spring Data JPA example matcher

Low · published June 3, 2019

CVSS v3.0
3.5
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

The record
Technical detail
CVSS v3.0
3.5 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01247 · 69.1th percentile
Weakness
CWE-155 · Improper Neutralization of Wildcards or Matching Symbols
Published
2019-06-03T13:47Z
EPSS history
Timeline
  • 03 JUN 13:47Z
    Additional information exposure with Spring Data JPA example matcher
    cvelistv5