Description

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

Remediation

References

CVE-2019-14900

Related Vulnerabilities

Drupal Core 8.6.x Remote Code Execution (8.6.0 - 8.6.9)

Apache Tomcat URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2026-25854)

Sqlite Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-20505)

Oracle HTTP Server Uncontrolled Search Path Element Vulnerability (CVE-2019-5443)

PostgreSQL Integer Overflow or Wraparound Vulnerability (CVE-2026-14677)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2019-14900