CVE-2019-14900
Description
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Risk Information
Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
1.272
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2019-14900 are fixed in Hibernate-hibernate-core 5.3.18 | Windows |
| Vulnerabilities CVE-2019-14900 are fixed in Hibernate-hibernate-core 5.4.18 | Windows |
| Vulnerabilities CVE-2019-14900 are fixed in Hibernate-hibernate-core 5.5.0 | Windows |
| Multiple Vulnerabilities are affected in Red Hat JBoss Data Grid 7.0.0 | Windows |
| Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.4 | Windows |
| Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.2 | Windows |
| Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.3 | Windows |
| Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 2.3 | Windows |
| Vulnerabilities CVE-2019-14900 are fixed in Hibernate-hibernate-core for Linux 5.3.18 | Linux |
| Vulnerabilities CVE-2019-14900 are fixed in Hibernate-hibernate-core for Linux 5.4.18 | Linux |
| Vulnerabilities CVE-2019-14900 are fixed in Hibernate-hibernate-core for Linux 5.5.0 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234