IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
3.5Niedrig

CVE-2019-3797Additional information exposure with Spring Data JPA derived queries

Spring Spring Boot Veröffentlicht: (vor 7 Jahren)

Beschreibung

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

Schwachstellentyp (CWE): CWE-89

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Spring Spring Boot 2.0 – < v2.0.9.RELEASE, 1.5 – < v1.5.20.RELEASE, 2.1 – < v2.1.4.RELEASE

Referenzen und Patches

Neue CVEs im selben Produkt — Spring Framework / Boot

3.7Niedrig
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Spring Spring Framework

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…

6.1Mittel
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…