CVE-2019-3797

Additional information exposure with Spring Data JPA derived queries

State: Published
Severity: 3.5 Low
Published: May 6, 2019
Updated: Sep 16, 2024
Reserved: Jan 3, 2019

Description

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

Scores

CVSS	Score	Vector	Source
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	dell

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
Spring BootSpring	2.0 to before v2.0.9.RELEASEAffected 1.5 to before v1.5.20.RELEASEAffected 2.1 to before v2.1.4.RELEASEAffected

References

https://pivotal.io/security/cve-2019-3797

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.