Is there a public PoC exploit available for CVE-2024-49203?

Yes, a public proof-of-concept exploit is available for CVE-2024-49203. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2024-49203?

Yes, a patch is available for CVE-2024-49203. Update the affected software to the latest version immediately.

JPAQuery. NOTE CVE-2024-49203

2024-11-20 cve@mitre.org

Code Injection

Lifecycle Timeline

CVE Published

Nov 20, 2024 - 21:15 cve.org

N/A

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

145 maven packages depend on com.querydsl:querydsl-apt (117 direct, 28 indirect)
267 maven packages depend on com.querydsl:querydsl-jpa (141 direct, 126 indirect)
3 maven packages depend on io.github.openfeign.querydsl:querydsl-apt (3 direct, 0 indirect)
1 maven packages depend on io.github.openfeign.querydsl:querydsl-jpa (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.1.0 and other introduced versions.

DescriptionCVE.org

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.

AnalysisAI

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. Public exploit code available and no vendor patch available.

Technical ContextAI

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.