CVE-2019-3802

Published: Jun 3, 2019Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Affected (3)

Products: Pivotal Software: Spring Data Java Persistance Api

Pivotal Software

1 product

Spring Data Java Persistance Api

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Spring Data Java Persistance Api	From 1.11.0 to 1.11.21
Pivotal Software Spring Data Java Persistance Api	From 2.0.0 to 2.0.14
Pivotal Software Spring Data Java Persistance Api	From 2.1.0 to 2.1.7

Related CWEs

CWE-155

Improper Neutralization of Wildcards or Matching Symbols

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.

References (2)

https://pivotal.io/security/cve-2019-3802

Source: security_alert@emc.com

Vendor Advisory

https://pivotal.io/security/cve-2019-3802

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.