The vulnerability in UTMStack before version 11.2.16 arises from the use of String.format() to build JPQL queries without parameter binding in the UtmNetworkScanService.searchPropertyValues() method. This improper query construction enables authenticated attackers to inject malicious JPQL code via the value parameter of the GET /api/utm-network-scans/searchPropertyValues endpoint. Exploitation can lead to unauthorized disclosure of sensitive data, including credential information stored in entity tables like jhi_user.

Successful exploitation allows an authenticated attacker to read arbitrary entity data from the database, potentially exposing sensitive information such as user credentials. The CVSS score of 6.5 (High) reflects the significant confidentiality impact without affecting integrity or availability.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users and monitor for suspicious activity related to JPQL injection attempts.