PT-2019-16726 · Spring · Spring Data Jpa
Maruthi Adithya G
·
Publicado
2019-05-06
·
Atualizado
2020-02-10
·
CVE-2019-3797
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Spring Data JPA versions up to and including 2.1.5
Spring Data JPA version 2.0.13
Spring Data JPA version 1.11.19
Description
The issue affects derived queries that use certain predicates, such as
startingWith, endingWith, or containing. When a maliciously crafted query parameter value is supplied, these queries could return more results than anticipated. Additionally, LIKE expressions in manually defined queries may return unexpected results if the parameter values bound do not have escaped reserved characters properly.Recommendations
For Spring Data JPA version 2.1.5, update to a version that includes the necessary fixes to prevent unexpected query results.
For Spring Data JPA version 2.0.13, update to a version that includes the necessary fixes to prevent unexpected query results.
For Spring Data JPA version 1.11.19, update to a version that includes the necessary fixes to prevent unexpected query results.
As a temporary workaround, consider properly escaping reserved characters in query parameter values to minimize the risk of exploitation.
Correção
Information Disclosure
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Spring Data Jpa