Additional information exposure with Spring Data JPA example matcher

The primary impact of CVE-2019-3802 is information disclosure. An attacker could craft a malicious example value to trigger an excessively broad query, retrieving a larger-than-expected dataset from the database. This could expose sensitive information that the attacker would not normally be able to access. The severity is rated LOW, suggesting the attack requires specific conditions and is unlikely to lead to widespread compromise. However, the potential for data exposure warrants prompt remediation.

Applications utilizing Spring Data JPA versions 1.11 through 2.1.8.RELEASE, particularly those employing ExampleMatcher with STARTING, ENDING, or CONTAINING string matchers, are at risk. This includes web applications, microservices, and backend systems that rely on Spring Data JPA for data access.

• java / server:

# Check Spring Data JPA version
java -jar your_application.jar | grep 'Spring Data JPA'

• java / server:

# Inspect application logs for unusually large query results or unexpected data retrieval.
# Look for patterns related to ExampleMatcher usage.

1. 2019-06-03Disclosure

   disclosure

1. 已保留2019-01-03
2. 发布日期2019-06-03
3. 修改日期2024-09-17
4. EPSS 更新日期2026-04-02

The recommended mitigation for CVE-2019-3802 is to upgrade to Spring Data JPA version 2.1.8.RELEASE or later. If upgrading is not immediately feasible, consider restricting the use of STARTING, ENDING, and CONTAINING string matchers within ExampleMatcher. Carefully validate and sanitize any user-supplied input used in example values to prevent malicious crafting. While a WAF cannot directly address this vulnerability, it can be configured to monitor for unusually large query responses and potentially block them.