What is GHSA-jgmr-wrwx-mgfj?

GHSA-jgmr-wrwx-mgfj is a security advisory published by GitHub Security Advisories with Medium severity. Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

Which CVE IDs does GHSA-jgmr-wrwx-mgfj cover?

GHSA-jgmr-wrwx-mgfj covers the following CVE IDs: CVE-2019-3797. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jgmr-wrwx-mgfj?

GHSA-jgmr-wrwx-mgfj has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-jgmr-wrwx-mgfj?

GHSA-jgmr-wrwx-mgfj affects 3 products, including: maven/org.springframework.data:spring-data-jpa:\u003c 1.11.20; maven/org.springframework.data:spring-data-jpa:\u003e= 2.0.0, \u003c 2.0.14; maven/org.springframework.data:spring-data-jpa:\u003e= 2.1.0, \u003c 2.1.6.

GHSA-jgmr-wrwx-mgfjMediumCVSS 5.3

Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

Vendor

GitHub Security Advisories

Published

May 14, 2019

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-3797 →

📋 Description

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

🎯 Affected products3

maven/org.springframework.data:spring-data-jpa:< 1.11.20
maven/org.springframework.data:spring-data-jpa:>= 2.0.0, < 2.0.14
maven/org.springframework.data:spring-data-jpa:>= 2.1.0, < 2.1.6

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2019-3797
https://pivotal.io/security/cve-2019-3797
https://github.com/advisories/GHSA-jgmr-wrwx-mgfj