CVE-2019-3802 Security Details

CVE ID

CVE-2019-3802

CWE

CWE-155

NVD-CWE-Other

CVE Description

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Published

May 15, 2019

CVSS Score & Severity

5.3Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

0.243%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/data/jpa/convert/QueryByExamplePredicateBuilder.getPredicates(Ljava/lang/String;Ljavax/persistence/criteria/CriteriaBuilder;Ljavax/persistence/criteria/Path;Ljavax/persistence/metamodel/ManagedType;Ljava/lang/Object;Ljava/lang/Class;Lorg/springframework/data/repository/core/support/ExampleMatcherAccessor;Lorg/springframework/data/jpa/convert/QueryByExamplePredicateBuilder$PathNode;)Ljava/util/List;

JVMVulnerable params: 0, 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

jira.spring.ioPROJECT

jira.spring.ioPROJECT

pivotal.ioPROJECT