org.springframework.data/spring-data-jpa vulnerabilities

Latest org.springframework.data/spring-data-jpa CVEs

Newest publication first

1. CVE-2019-3802 Additional information exposure with Spring Data JPA example matcher

   Published 2019-06-03

   Medium·CVSS 5.3 EPSS 1.2%

   This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a mal...

2. CVE-2019-3797 Additional information exposure with Spring Data JPA derived queries

   Published 2019-05-06

   Medium·CVSS 5.3 EPSS 1.1%

   This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied...

3. CVE-2016-6652 Improper Neutralization of Special Elements used in an SQL Command Pivotal Spring Data JPA

   Published 2016-10-05

   Medium·CVSS 5.6 EPSS 0.82%

   SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance wi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.