CVE-2019-14900

2020-07-0618:35:01

redhat

www.cve.org

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.6%

JSON

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

CNA Affected

[
  {
    "product": "Hibernate",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions before Hibernate ORM 5.3.18"
      },
      {
        "status": "affected",
        "version": "Versions before Hibernate ORM 5.4.18"
      },
      {
        "status": "affected",
        "version": "Versions before Hibernate ORM 5.5.0.Beta1"
      }
    ]
  }
]