4.8Media
Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Spring Spring Data Relational; Spring Spring Data JDBC; Spring Spring Data R2DBC
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data …