CVE-2019-14900

Published: Jul 6, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

Affected (16)

Products: Hibernate: Hibernate Orm · Redhat: Build Of Quarkus, Decision Manager, Fuse, Jboss Data Grid, Jboss Enterprise Application Platform, Jboss Middleware Text Only Advisories, Openstack, Single Sign On · Quarkus: Quarkus

1 product

8 products

Jboss Enterprise Application Platform

Jboss Middleware Text Only Advisories

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hibernate Hibernate Orm	Before 5.3.18
Hibernate Hibernate Orm	From 5.4.0 to 5.4.18

Configuration B

10 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Quarkus	All versions
Redhat Decision Manager	Version 7.0
Redhat Fuse	Before 7.8.0
Redhat Jboss Data Grid	Version 7.0.0
Redhat Jboss Enterprise Application Platform	All versions
Redhat Jboss Middleware Text Only Advisories	All versions
Redhat Openstack	Version 10
Redhat Openstack	Version 13
Redhat Openstack	Version 14
Redhat Single Sign On	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Quarkus Quarkus	Up to 1.5.2

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.4

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.3

Configuration G

1 platform

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 8.0

Configuration H

1 platform

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 7.0

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.2

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (6)

https://bugzilla.redhat.com/show_bug.cgi?id=1666499

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20220210-0020/

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1666499

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20220210-0020/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.