{"id":"CVE-2016-6652","aliases":["EUVD-2022-5849","GHSA-xr4v-28rm-pvgw"],"status":"published","title":"Improper Neutralization of Special Elements used in an SQL Command  Pivotal Spring Data JPA","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","severity":{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00822,"percentile":0.57557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2016-10-05T16:00:00Z","modified":"2026-10-20T10:47:56Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.data:spring-data-jpa","fixed_in":["1.9.6","1.10.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6"}]}],"versions":["1.0.0.RELEASE","1.0.1.RELEASE","1.0.2.RELEASE","1.0.3.RELEASE","1.1.0.RELEASE","1.1.1.RELEASE","1.1.2.RELEASE","1.2.0.RELEASE","1.2.1.RELEASE","1.3.0.RELEASE","1.3.1.RELEASE","1.3.2.RELEASE","1.3.3.RELEASE","1.3.4.RELEASE","1.3.5.RELEASE","1.4.0.RELEASE","1.4.1.RELEASE","1.4.2.RELEASE","1.4.3.RELEASE","1.4.4.RELEASE","1.4.5.RELEASE","1.5.0.RELEASE","1.5.1.RELEASE","1.5.2.RELEASE","1.5.3.RELEASE","1.6.0.RELEASE","1.6.1.RELEASE","1.6.2.RELEASE","1.6.4.RELEASE","1.6.5.RELEASE","1.6.6.RELEASE","1.7.0.RELEASE","1.7.1.RELEASE","1.7.2.RELEASE","1.7.3.RELEASE","1.7.4.RELEASE","1.8.0.RC1","1.8.0.RELEASE","1.8.1.RELEASE","1.8.2.RELEASE","1.9.0.RELEASE","1.9.1.RELEASE","1.9.2.RELEASE","1.9.4.RELEASE","1.9.5.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.4"}]}],"versions":["1.10.0.RELEASE","1.10.1.RELEASE","1.10.2.RELEASE","1.10.3.RELEASE"]}],"products":[{"vendor":"pivotal_software","product":"spring_data_jpa"}],"references":[{"url":"http://www.securityfocus.com/bid/93276","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://jira.spring.io/browse/DATAJPA-965","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://pivotal.io/security/cve-2016-6652","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201701-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://github.com/spring-projects/spring-data-jpa/commit/b8e7fe","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6652","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xr4v-28rm-pvgw"}],"sources":{"cve":[{"id":"CVE-2016-6652","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","status":"published","published":"2016-10-05T16:00:00Z","modified":"2024-08-06T01:36:29.349Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2022-5849","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","status":"published","published":"2016-10-05T16:00:00Z","modified":"2024-08-06T01:36:29Z","updated_at":"2026-11-03T02:22:35.505212Z"}],"ghsa":[{"id":"GHSA-xr4v-28rm-pvgw","title":"Improper Neutralization of Special Elements used in an SQL Command  Pivotal Spring Data JPA","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","status":"published","published":"2022-05-17T02:37:09Z","modified":"2023-01-27T05:02:35Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2016-6652","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","status":"published","published":"2016-10-05T16:59:04.757Z","modified":"2026-06-17T00:51:32.19Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"CVE-2016-6652","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","status":"published","published":"2016-10-05T16:59:04.757Z","modified":"2026-10-20T10:47:56.412634866Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"GHSA-xr4v-28rm-pvgw","title":"Improper Neutralization of Special Elements used in an SQL Command  Pivotal Spring Data JPA","description":"SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.","status":"published","published":"2022-05-17T02:37:09Z","modified":"2023-11-08T03:58:33.104301Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}