hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

🗓️ 23 Nov 2020 13:27:26Reported by RedHatType

Hibernate core up to 5.4.23.Final has injection via Java Persistence Criteria with literals in Structured Query Language comments.

Reporter	Title	Published	Views	Family All 99
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to SQL injection due to use of Hibernate ORM (CVE-2020-25638)	3 Nov 202216:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	2 Feb 202105:06	–	ibm
IBM Security Bulletins	Security Bulletin: Hibernate ORM Vulnerabilities Affect IBM Control Center (CVE-2019-14900, CVE-2020-25638)	14 May 202121:22	–	ibm
AstraLinux	Astra Linux – Vulnerability in libhibernate3-java	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the JPA Criteria API interface of the Hibernate ORM query service allows attackers to gain access to confidential data and compromise its integrity.	20 Jan 202200:00	–	bdu_fstec
Circl	CVE-2020-25638	2 Dec 202018:55	–	circl
CNNVD	Red Hat Hibernate ORM SQL Injection Vulnerability	19 Nov 202000:00	–	cnnvd
CVE	CVE-2020-25638	2 Dec 202014:36	–	cve
Cvelist	CVE-2020-25638	2 Dec 202014:36	–	cvelist
Debian	[SECURITY] [DLA 2512-1] libhibernate3-java security update	3 Jan 202122:30	–	debian

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-25638
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-25638
cve	www.cve.org/CVERecord

28 Jun 2026 12:33Current

7.2High risk

Vulners AI Score7.2

CVSS 25.8

CVSS 3.17.4

EPSS0.02907

SSVC