CVE-2019-3797
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2019
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Additional information exposure with Spring Data JPA derived queries
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Spring Boot
- Vendor
- Spring
- Product
- Spring Boot
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.0 | affected | custom | v2.0.9.RELEASE | Unavailable | None listed |
| 1.5 | affected | custom | v1.5.20.RELEASE | Unavailable | None listed |
| 2.1 | affected | custom | v2.1.4.RELEASE | Unavailable | None listed |