CVE-2019-14900
Medium
Description
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Hibernate Orm
PublishedJul 6, 2020
First seenJul 6, 2020
How to fix
Update
- hibernate hibernate_orm5.3.18, 5.4.18 or later
- redhat fuse7.8.0 or later
- org.hibernate:hibernate-core5.3.18, 5.4.18, 5.5.0.Beta1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hibernate hibernate_orm | v < 5.3.18, 5.4.0 ≤ v < 5.4.18 | 5.3.18, 5.4.18 |
| redhat build_of_quarkus | No range specified | — |
| redhat decision_manager | 7.0 | — |
| redhat fuse | v < 7.8.0 | 7.8.0 |
| redhat jboss_data_grid | 7.0.0 | — |
| redhat jboss_enterprise_application_platform | No range specified, 7.3, 7.4, 7.2 | — |
| redhat jboss_middleware_text-only_advisories | No range specified | — |
| redhat openstack | 10, 13, 14 | — |
| redhat single_sign-on | No range specified | — |
| quarkus quarkus | v ≤ 1.5.2 | — |
| org.hibernate:hibernate-coreMaven | v < 5.3.18, 5.4.0 ≤ v < 5.4.18, 5.5.0.Alpha1 ≤ v < 5.5.0.Beta1 | 5.3.18, 5.4.18, 5.5.0.Beta1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.