3.5
Faible
CVE-2019-3797 This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19
Description
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Boot 2.1 | 2.1 → < 2.1.4.RELEASE | 2.1.4.RELEASE |
| Spring Boot 2.0 | 2.0 → < 2.0.9.RELEASE | 2.0.9.RELEASE |
| Spring Boot 1.5 | 1.5 → < 1.5.20.RELEASE | 1.5.20.RELEASE |
Références
- pivotal.io pivotal.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Boot
Les 15 CVE de Spring Boot →
CVE-2026-41001
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's…
5.3
Moyenne
CVE-2026-40992
Spring Boot's Mail auto-configuration does not enable hostname verification
5.0
Moyenne
CVE-2026-40977
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID…
4.7
Moyenne
CVE-2026-40976
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…
9.1
Critique