Vulnerability in N/a
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (32.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 32.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Public proof-of-concept exploits
References
- github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0
- www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html
- github.com/querydsl/querydsl/issues/3757
- github.com/OpenFeign/querydsl/
- github.com/OpenFeign/querydsl/releases/tag/5.6.1
- github.com/OpenFeign/querydsl/pull/742
- github.com/advisories/GHSA-6q3q-6v5j-h6vg
- github.com/OpenFeign/querydsl/releases/tag/6.10.1
- github.com/OpenFeign/querydsl/pull/743
- github.com/spring-projects/spring-data-jpa/issues/3693
Frequently asked questions
- What is CVE-2024-49203?
- CVE-2024-49203 is a vulnerability in N/a. Published 2024-11-20.
- Is CVE-2024-49203 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.