CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery

published November 20, 2024

CVSS
—
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.3th percentile
Published
2024-11-20T00:00Z
EPSS history
Timeline
  • 20 NOV 00:00Z
    Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery
    cvelistv5