Skip to content
Sign in
3.5 Low

CVE-2019-3802 This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20

Description

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Affected products and versions

Product Affected versions Fixed in
Spring Data JPA 2.1 2.1 → < 2.1.8.RELEASE 2.1.8.RELEASE
Spring Data JPA 1.11 1.11 → < 1.11.22.RELEASE 1.11.22.RELEASE

Other CVEs of Spring Data JPA

The 2 CVEs of Spring Data JPA →
CVE-2026-47834 Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted… 4.8 Medium
Track this CVE