CVE-2019-11343: Vulnerability in Torpedo Query
Summary
CVE-2019-11343: Vulnerability in Torpedo Query. Affects org.torpedoquery:org.torpedoquery versions < 2.5.3. Fixed in 2.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Torpedo Query is a Maven package that provides a query builder for Java applications. It allows developers to construct SQL queries in a type-safe and fluent manner. The package is widely used in various projects and provides a convenient way to interact with databases. However, a vulnerability has been discovered in Torpedo Query versions prior to 2.5.3.
Vulnerability Detail
The vulnerability in Torpedo Query resides in the handling of the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java. Due to improper implementation, an attacker can exploit this vulnerability to execute arbitrary SQL queries or perform SQL injection attacks. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Torpedo Query to mitigate the risk of exploitation.
Conclusion
In conclusion, the vulnerability in Torpedo Query versions prior to 2.5.3 can be exploited to execute arbitrary SQL queries or perform SQL injection attacks. It is crucial for developers using Torpedo Query to upgrade to the fixed version to ensure the security and integrity of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.torpedoquery:org.torpedoquery →
FAQ
Torpedo Query is a Maven package that provides a query builder for Java applications. It allows developers to construct SQL queries in a type-safe and fluent manner.
The vulnerability in Torpedo Query can be exploited to execute arbitrary SQL queries or perform SQL injection attacks. This can lead to unauthorized access, data leakage, or complete compromise of the affected system.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade to Torpedo Query version 2.5.3 or later. This version includes the necessary patches and fixes to address the vulnerability.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Torpedo Query to mitigate the risk of exploitation.
