CVE-2019-3797GHSA-JGMR-WRWX-MGFJ
Additional information exposure with Spring Data JPA derived queries
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in v2.0.9.RELEASE, v1.5.20.RELEASE, v2.1.4.RELEASE, 1.11.20, 2.0.14, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Timeline
- CVE published
- Record last updated
Affected versions
- Spring Spring Boot
From 2.0 · fixed in v2.0.9.RELEASE; From 1.5 · fixed in v1.5.20.RELEASE; From 2.1 · fixed in v2.1.4.RELEASE
- org.springframework.data:spring-data-jpaMaven
fixed in 1.11.20
- org.springframework.data:spring-data-jpaMaven
From 2.0.0 · fixed in 2.0.14
- org.springframework.data:spring-data-jpaMaven
From 2.1.0 · fixed in 2.1.6