GitHub Advisoryadvisory · Maven

GHSA-8grg-q944-cch5 SQL Injection in Hibernate ORM

MEDIUM Published 2022-02-10 Modified 2024-06-27 Official page ↗
Aliases
CVE-2019-14900
Ecosystem
Maven
Packages
org.hibernate:hibernate-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2021-05-11

Affected packages

• Maven org.hibernate:hibernate-core: < 5.3.18 → fixed in 5.3.18 • Maven org.hibernate:hibernate-core: >= 5.4.0, < 5.4.18 → fixed in 5.4.18 • Maven org.hibernate:hibernate-core: >= 5.5.0.Alpha1, < 5.5.0.Beta1 → fixed in 5.5.0.Beta1

Description

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

Related

Alias · CVE (1)

  • CVE-2019-14900 A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References