5.3
CVE-2019-3802
- EPSS 0.24%
- Published 03.06.2019 14:29:00
- Last modified 21.11.2024 04:42:34
- Source security_alert@emc.com
- Teams watchlist Login
- Open Login
This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.
Data is provided by the National Vulnerability Database (NVD)
Pivotal Software ≫ Spring Data Java Persistance Api Version >= 1.11.0 <= 1.11.21
Pivotal Software ≫ Spring Data Java Persistance Api Version >= 2.0.0 <= 2.0.14
Pivotal Software ≫ Spring Data Java Persistance Api Version >= 2.1.0 <= 2.1.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.447 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
| security_alert@emc.com | 3.5 | 2.1 | 1.4 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
|
CWE-155 Improper Neutralization of Wildcards or Matching Symbols
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.