CVE-2019-3802

Additional information exposure with Spring Data JPA example matcher

State: Published
Severity: 3.5 Low
Published: Jun 3, 2019
Updated: Sep 17, 2024
Reserved: Jan 3, 2019

Description

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Scores

CVSS	Score	Vector	Source
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	dell

Weaknesses

CWE-155 Improper Neutralization of Wildcards or Matching Symbols

Affected Products

Product	Versions
Spring Data JPASpring	2.1 to before 2.1.8.RELEASEAffected 1.11 to before 1.11.22.RELEASEAffected

References

https://pivotal.io/security/cve-2019-3802

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.