{"dataType":"CVE_RECORD","cveMetadata":{"state":"PUBLISHED","cveId":"CVE-2024-49203","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","dateUpdated":"2025-02-21T16:52:31.005Z","dateReserved":"2024-10-14T00:00:00.000Z","datePublished":"2024-11-20T00:00:00.000Z"},"containers":{"cna":{"providerMetadata":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2025-02-13T16:22:20.617Z"},"descriptions":[{"lang":"en","value":"Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0"},{"url":"https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html"},{"url":"https://github.com/querydsl/querydsl/issues/3757"},{"url":"https://github.com/OpenFeign/querydsl/"},{"url":"https://github.com/OpenFeign/querydsl/releases/tag/5.6.1"},{"url":"https://github.com/OpenFeign/querydsl/pull/742"},{"url":"https://github.com/advisories/GHSA-6q3q-6v5j-h6vg"},{"url":"https://github.com/OpenFeign/querydsl/releases/tag/6.10.1"},{"url":"https://github.com/OpenFeign/querydsl/pull/743"},{"url":"https://github.com/spring-projects/spring-data-jpa/issues/3693"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"tags":["disputed"]},"adp":[{"affected":[{"vendor":"querydsl","product":"querydsl","cpes":["cpe:2.3:a:querydsl:querydsl:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"5.1.0","status":"affected"}]},{"vendor":"openfeign_querydsl","product":"openfeign_querydsl","cpes":["cpe:2.3:a:openfeign_querydsl:openfeign_querydsl:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"6.8","status":"affected"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-03T15:45:11.323740Z","id":"CVE-2024-49203","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-21T16:52:31.005Z"}}]},"dataVersion":"5.1"}