CVE-2024-49203
No CVSS score yet. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in io.github.openfeign.querydsl:querydsl-jpa 5.6.1, 6.10.1.
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6q3q-6v5j-h6vg | Maven | io.github.openfeign.querydsl:querydsl-jpa | >=6.0.0.M1 <6.10.1 | 6.10.1 |
| GHSA-6q3q-6v5j-h6vg | Maven | io.github.openfeign.querydsl:querydsl-apt | >=6.0.0.M1 <6.10.1 | 6.10.1 |
| GHSA-6q3q-6v5j-h6vg | Maven | io.github.openfeign.querydsl:querydsl-jpa | <5.6.1 | 5.6.1 |
| GHSA-6q3q-6v5j-h6vg | Maven | io.github.openfeign.querydsl:querydsl-apt | <5.6.1 | 5.6.1 |
| GHSA-6q3q-6v5j-h6vg | Maven | com.querydsl:querydsl-jpa | <=5.1.0 | no fix published |
| GHSA-6q3q-6v5j-h6vg | Maven | com.querydsl:querydsl-apt | <=5.1.0 | no fix published |