Path to vulnerable library: /target/JavaVulnerableLab/WEB-INF/lib/hibernate-core-4.0.1.Final.jar,/er/.m2/repository/org/hibernate/hibernate-core/4.0.1.Final/hibernate-core-4.0.1.Final.jar
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
CVE-2019-14900 - Medium Severity Vulnerability
A module of the Hibernate Core project
Library home page: http://hibernate.org
Path to dependency file: /pom.xml
Path to vulnerable library: /target/JavaVulnerableLab/WEB-INF/lib/hibernate-core-4.0.1.Final.jar,/er/.m2/repository/org/hibernate/hibernate-core/4.0.1.Final/hibernate-core-4.0.1.Final.jar
Dependency Hierarchy: - :x: **hibernate-core-4.0.1.Final.jar** (Vulnerable Library)
Found in HEAD commit: 2268241dee1b615db7b95c4495882467c7cd1127
Found in base branch: master
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Publish Date: 2020-07-06
URL: CVE-2019-14900
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14900
Release Date: 2020-07-06
Fix Resolution: 5.1.10.Final
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.