Non évaluée
SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository t...
CVE-2016-6652
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory jira.spring.io
- advisory pivotal.io
- advisory security.gentoo.org
- patch github.com
- web securityfocus.com