diff --git a/owasp.xml b/owasp.xml index c504d51e0f..125e5e37f6 100644 --- a/owasp.xml +++ b/owasp.xml @@ -72,4 +72,22 @@ CVE-2024-23076 + + + https://nvd.nist.gov/vuln/detail/CVE-2024-49203 + https://github.com/querydsl/querydsl/issues/3757 + + Basically if you allow untrusted user input to be used in the "ORDER BY" clause + you can be vulnerable to SQL injection. + + I believe this is nonsense and akin to saying every Java application has a + security vulnerability because JDBC allows you to execute arbitrary SQL if you + do not properly use PreparedStatement with parameters over a string-concatenated + Statement. + + Even if this is considered a valid vulnerability we do not, currently, allow + untrusted user input to be used in the "ORDER BY" clause. + + CVE-2024-49203 +