CVE-2019-3797: Query Injection in Spring Data JPA

This vulnerability allows an attacker to manipulate database queries through crafted input, potentially retrieving more data than intended. The impact ranges from unauthorized data disclosure to, in some cases, denial of service if the query overload impacts database performance. The risk is amplified in applications that directly expose user-supplied data in these predicates without proper sanitization. While the CVSS score is LOW, the ease of exploitation and potential for sensitive data leakage make this a significant concern, particularly in applications handling personally identifiable information (PII) or financial data. The vulnerability stems from a lack of proper escaping of reserved characters within LIKE expressions and derived queries.

1. Reserved2019-01-03
2. Published2019-05-06
3. Modified2024-09-16
4. EPSS updated2026-04-02

The primary mitigation is to upgrade to Spring Data JPA version 2.1.4.RELEASE or later, which includes the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all user-supplied data used in derived queries. Specifically, ensure that any parameters used with ‘startingWith’, ‘endingWith’, or ‘containing’ predicates are properly escaped to prevent query manipulation. WAF rules can be configured to detect and block suspicious query patterns containing these predicates with unusual characters. Thorough testing of all data access layers is crucial after applying any mitigation.