CVE-2019-14900
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2020-07-06
- Last modified
- 2024-08-05
- Weaknesses
- CWE-89
Affected products
- Hibernate Orm (Hibernate)
- Quarkus (Quarkus)
- Build Of Quarkus (Redhat)
- Decision Manager (Redhat)
- Fuse (Redhat)
- Jboss Data Grid (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Middleware Text-only Advisories (Redhat)
- Openstack (Redhat)
- Single Sign-on (Redhat)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1666499
- https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.…
- https://security.netapp.com/advisory/ntap-20220210-0020/
