IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
3.5Baja

CVE-2019-3797Additional information exposure with Spring Data JPA derived queries

Spring Spring Boot Publicada: (hace 7 años)

Descripción

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

Debilidad (CWE): CWE-89

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Spring Spring Boot 2.0 – < v2.0.9.RELEASE, 1.5 – < v1.5.20.RELEASE, 2.1 – < v2.1.4.RELEASE

Referencias y parches

CVE recientes del mismo producto — Spring Framework / Boot

3.7Baja
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Spring Spring Framework

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…

6.1Media
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…