A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1666499 | Issue Tracking Third Party Advisory |
| https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E | |
| https://security.netapp.com/advisory/ntap-20220210-0020/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
History
07 Nov 2023, 03:05
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
29 Apr 2022, 17:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:* |
21 Feb 2022, 04:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat jboss Enterprise Application Platform
Redhat jboss Middleware Text-only Advisories Redhat build Of Quarkus Redhat fuse Redhat enterprise Linux Redhat single Sign-on |
|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220210-0020/ - Third Party Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44@%3Cdev.turbine.apache.org%3E - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:text-only:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:* |
10 Feb 2022, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Dec 2021, 21:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MLIST) https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44@%3Cdev.turbine.apache.org%3E - Exploit |
15 Oct 2021, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Aug 2021, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:openstack:14.0:*:*:*:*:*:*:* |
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* |
15 Mar 2021, 17:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |
Information
Published : 2020-07-06 19:15
Updated : 2023-12-10 13:27
NVD link : CVE-2019-14900
Mitre link : CVE-2019-14900
CVE.ORG link : CVE-2019-14900
JSON object : View
Products Affected
redhat
- jboss_middleware_text-only_advisories
- single_sign-on
- enterprise_linux
- fuse
- decision_manager
- openstack
- build_of_quarkus
- jboss_enterprise_application_platform
- jboss_data_grid
quarkus
- quarkus
hibernate
- hibernate_orm
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')