Is there a public PoC exploit available for CVE-2024-49203?

Yes, a public proof-of-concept exploit is available for CVE-2024-49203. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2024-49203?

Yes, a patch is available for CVE-2024-49203. Update the affected software to the latest version immediately.

JPAQuery. NOTE CVE-2024-49203

2024-11-20 cve@mitre.org

Code Injection

Lifecycle Timeline

CVE Published

Nov 20, 2024 - 21:15 cve.org

N/A

DescriptionCVE.org

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.

AnalysisAI

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. Public exploit code available and no vendor patch available.

Technical ContextAI

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.