What is CVE-2019-3797?

CVE-2019-3797 is a low-severity vulnerability in Pivotal_software Spring_data_java_persistence_api, classified under SQL Injection. CVSS score: 3.5/10. Published 2019-05-06.

How severe is CVE-2019-3797?

Low severity. CVSS v3 base score is 3.5 out of 10.

SQL Injection in Pivotal_software Spring_data_java_persistence_api

CVE-2019-3797

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously…

Vulnerability class: SQL Injection

EPSS: 0.011 (61.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N.

Affected products

Pivotal_software Spring_data_java_persistence_api
Spring Boot — versions 2.0, 1.5, 2.1

Weakness classification (CWE)

References

security_alert@emc.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-3797?: CVE-2019-3797 is a low-severity vulnerability in Pivotal_software Spring_data_java_persistence_api, classified under SQL Injection. CVSS score: 3.5/10. Published 2019-05-06.
How severe is CVE-2019-3797?: Low severity. CVSS v3 base score is 3.5 out of 10.