Improper Neutralization of Wildcards or Matching Symbols

2019-06-0415:42:15

Google

osv.dev

0.001 Low

EPSS

Percentile

36.1%

JSON

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

CPENameOperatorVersion
org.springframework.data:spring-data-jpaeq2.0.1.RELEASE
org.springframework.data:spring-data-jpaeq1.11.18.RELEASE
org.springframework.data:spring-data-jpaeq1.8.1.RELEASE
org.springframework.data:spring-data-jpaeq2.0.3.RELEASE
org.springframework.data:spring-data-jpaeq1.10.10.RELEASE
org.springframework.data:spring-data-jpaeq2.1.3.RELEASE
org.springframework.data:spring-data-jpaeq1.10.6.RELEASE
org.springframework.data:spring-data-jpaeq1.11.3.RELEASE
org.springframework.data:spring-data-jpaeq1.5.2.RELEASE
org.springframework.data:spring-data-jpaeq1.1.2.RELEASE

Name	Operator	Version
org.springframework.data:spring-data-jpa	eq	2.0.1.RELEASE
org.springframework.data:spring-data-jpa	eq	1.11.18.RELEASE
org.springframework.data:spring-data-jpa	eq	1.8.1.RELEASE
org.springframework.data:spring-data-jpa	eq	2.0.3.RELEASE
org.springframework.data:spring-data-jpa	eq	1.10.10.RELEASE
org.springframework.data:spring-data-jpa	eq	2.1.3.RELEASE
org.springframework.data:spring-data-jpa	eq	1.10.6.RELEASE
org.springframework.data:spring-data-jpa	eq	1.11.3.RELEASE
org.springframework.data:spring-data-jpa	eq	1.5.2.RELEASE
org.springframework.data:spring-data-jpa	eq	1.1.2.RELEASE