GitHub Advisoryadvisory · Maven

GHSA-xggx-fx6w-v7ch Improper Neutralization of Wildcards or Matching Symbols

MEDIUM Published 2019-06-04 Modified 2021-08-04 Official page ↗
Aliases
CVE-2019-3802
Ecosystem
Maven
Packages
org.springframework.data:spring-data-jpa
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-155, CWE-200
Reviewed
2019-06-04

Affected packages

• Maven org.springframework.data:spring-data-jpa: >= 2.1.0, < 2.1.8 → fixed in 2.1.8 • Maven org.springframework.data:spring-data-jpa: >= 2.0.0, < 2.1.8 → fixed in 2.1.8 • Maven org.springframework.data:spring-data-jpa: < 1.11.22 → fixed in 1.11.22

Description

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Related

Alias · CVE (1)

  • CVE-2019-3802 This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. vulnerability

Weakness · CWE (2)

  • CWE-155 Improper Neutralization of Wildcards or Matching Symbols weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References