Vulnerability · Published Nov 20, 2024 · Assigned by mitre
CVE-2024-49203
Unrated
In plain English
A security flaw in the com.querydsl:querydsl-apt package (Maven). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS )–Not rated
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.querydsl:querydsl-apt | no fix listed | GHSA-6q3q-6v5j-h6vg |
| Maven | com.querydsl:querydsl-jpa | no fix listed | GHSA-6q3q-6v5j-h6vg |
| Maven | io.github.openfeign.querydsl:querydsl-apt | 6.10.1 | GHSA-6q3q-6v5j-h6vg |
| Maven | io.github.openfeign.querydsl:querydsl-apt | 5.6.1 | GHSA-6q3q-6v5j-h6vg |
| Maven | io.github.openfeign.querydsl:querydsl-jpa | 6.10.1 | GHSA-6q3q-6v5j-h6vg |
| Maven | io.github.openfeign.querydsl:querydsl-jpa | 5.6.1 | GHSA-6q3q-6v5j-h6vg |
Affected products (as reported)
References
- https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0
- https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html
- https://github.com/querydsl/querydsl/issues/3757
- https://github.com/OpenFeign/querydsl/
- https://github.com/OpenFeign/querydsl/releases/tag/5.6.1
- https://github.com/OpenFeign/querydsl/pull/742
- https://github.com/advisories/GHSA-6q3q-6v5j-h6vg
- https://github.com/OpenFeign/querydsl/releases/tag/6.10.1
- https://github.com/OpenFeign/querydsl/pull/743
- https://github.com/spring-projects/spring-data-jpa/issues/3693