DMC/scipro
7
0
Fork 0
Code Issues 20 Pull Requests 1 Actions Projects 1 Wiki Activity

Suppress warning about CVE-2024-49203 #71

Merged
tozh4728 merged 1 commits from cve-2024-49203 into develop 2025-01-09 12:54:44 +01:00
Conversation 2 Commits 1 Files Changed 1 +18
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
owasp.xml
View File

@ -72,4 +72,22 @@
</notes> </notes>
<cve>CVE-2024-23076</cve> <cve>CVE-2024-23076</cve>
</suppress> </suppress>
<suppress>
<notes>
https://nvd.nist.gov/vuln/detail/CVE-2024-49203
https://github.com/querydsl/querydsl/issues/3757
Basically if you allow untrusted user input to be used in the "ORDER BY" clause
you can be vulnerable to SQL injection.
I believe this is nonsense and akin to saying every Java application has a
security vulnerability because JDBC allows you to execute arbitrary SQL if you
do not properly use PreparedStatement with parameters over a string-concatenated
Statement.
Even if this is considered a valid vulnerability we do not, currently, allow
untrusted user input to be used in the "ORDER BY" clause.
</notes>
<cve>CVE-2024-49203</cve>
</suppress>
</suppressions> </suppressions>