CVE-2016-6652: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

May 17, 2022 (updated July 6, 2022)

SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.

References

www.securityfocus.com/bid/93276
github.com/advisories/GHSA-xr4v-28rm-pvgw
github.com/spring-projects/spring-data-jpa/commit/b8e7fe
jira.spring.io/browse/DATAJPA-965
nvd.nist.gov/vuln/detail/CVE-2016-6652
pivotal.io/security/cve-2016-6652
security.gentoo.org/glsa/201701-01

Detect and mitigate CVE-2016-6652 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →