CVE-2020-25638 — SQL Injection in Hibernate ORM

CWE-89 — SQL Injection12 documents8 sources
Severity
7.4HIGHNVD
EPSS
0.8%
top 25.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Hibernate ORMQuarkusDebian Linux+2 more
Timeline
PublishedDec 2
Latest updateApr 15

Description

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages4 packages

▶NVDhibernate/hibernate_orm5.4.0 — 5.4.24+1
▶NVDquarkus/quarkus1.9.2

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
SQL injection in hibernate-core↗2022-02-09
▶
GHSA
SQL injection in hibernate-core↗2022-02-09
▶
CVEList
CVE-2020-25638: A flaw was found in hibernate-core in versions prior to and including 5↗2020-12-02
▶
OSV
CVE-2020-25638: A flaw was found in hibernate-core in versions prior to and including 5↗2020-12-02
▶

📋Vendor Advisories

6
Oracle
Oracle Oracle Utilities Applications Risk Matrix: General (hibernate-core) — CVE-2020-25638↗2024-04-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Core (JBoss Enterprise Application Platform) — CVE-2020-25638↗2023-04-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: CNC Console (hibernate-core) — CVE-2020-25638↗2022-04-15
▶
Oracle
Oracle Oracle Retail Applications Risk Matrix: Segment (Hibernate) — CVE-2020-25638↗2021-07-15
▶
Red Hat
hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used↗2020-10-01
▶

💬Community

1
Bugzilla
CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used↗2020-09-22
▶
CVE-2020-25638 — SQL Injection in Hibernate ORM | cvebase