CVE-2016-6652

Name: CVE-2016-6652
Creator: NVD / NIST
Published: 2016-10-05T16:59:04.757+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.82%

Last modified Jun 17, 2026

CVE-2016-6652 is a vulnerability of currently unknown severity. SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.. EPSS estimates a 0.82% chance of exploitation in the next 30 days.

Description

SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.

Metrics

EPSS Probability

0.82%

52.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-89

Affected Software

Vendor	Product	Versions
Pivotal Software	Spring Data Jpa	<= 1.9.4
Pivotal Software	Spring Data Jpa	1.10.2

References

http://www.securityfocus.com/bid/93276
https://github.com/spring-projects/spring-data-jpa/commit/b8e7fePatch
https://jira.spring.io/browse/DATAJPA-965Mitigation, Vendor Advisory
https://pivotal.io/security/cve-2016-6652Vendor Advisory
https://security.gentoo.org/glsa/201701-01
http://www.securityfocus.com/bid/93276
https://github.com/spring-projects/spring-data-jpa/commit/b8e7fePatch
https://jira.spring.io/browse/DATAJPA-965Mitigation, Vendor Advisory
https://pivotal.io/security/cve-2016-6652Vendor Advisory
https://security.gentoo.org/glsa/201701-01

Timeline

Published: Oct 5, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-6652?

How severe is CVE-2016-6652?

Severity scoring for CVE-2016-6652 is pending analysis. The EPSS model estimates a 0.82% probability of exploitation in the next 30 days.

How do I fix CVE-2016-6652?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-6652?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST