CVE-2019-3797: Additional information exposure with Spring Data JPA derived queries
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3797?
CVE-2019-3797 is a vulnerability affecting Spring Data JPA versions up to and including 2.1.5, 2.0.13, and 1.11.19.
What is the severity of CVE-2019-3797?
The severity of CVE-2019-3797 is medium with a severity value of 5.3.
How does CVE-2019-3797 affect Spring Data JPA?
CVE-2019-3797 affects Spring Data JPA by allowing derived queries using 'startingWith', 'endingWith', or 'containing' predicates to return more results than expected when a malicious query parameter value is used.
Which software versions are affected by CVE-2019-3797?
Spring Data JPA versions up to and including 2.1.5, 2.0.13, and 1.11.19 are affected by CVE-2019-3797.
How can I fix CVE-2019-3797?
To fix CVE-2019-3797, upgrade to Spring Data JPA version 2.1.6, 2.0.14, or 1.11.20, depending on the version you are using.