CVE-2020-25638

HIGH

hibernate-core < 5.4.24.Final - SQL Injection via JPA Criteria API Literal Handling

Title source: llm
STIX 2.1

Description

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

References (8)

Core 8
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1881353
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/01/msg00000.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4908
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com//security-alerts/cpujul2021.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2022.html

Scores

CVSS v3 7.4
EPSS 0.0291
EPSS Percentile 85.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (7)
debian/debian_linux 9.0
debian/debian_linux 10.0
hibernate/hibernate_orm < 5.3.20
oracle/communications_cloud_native_core_console 1.9.0
oracle/retail_customer_management_and_segmentation_foundation 19.0
org.hibernate/hibernate-core 5.4.0.Final - 5.4.24.FinalMaven
quarkus/quarkus < 1.9.2
Published Dec 02, 2020
Tracked Since Feb 18, 2026