CVE-2019-14900 json
SQL Injection in Hibernate ORM
published 2020-07-06 6 y ago modified 2026-06-17 4 mo ago also GHSA-8grg-q944-cch5 , EUVD-2022-0917
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Patch / fix
- maven org.hibernate:hibernate-core 5.3.18, 5.4.18, 5.5.0.Beta1
- hibernate hibernate_orm 5.3.18, 5.4.18
- redhat fuse 7.8.0
- eap7-dom4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.1.3-1.redhat_00001.1.el8eap
- eap7-wildfly jboss enterprise application platform 7.2 7.2.9-4.GA_redhat_00003.1.el8eap
- eap7-resteasy jboss enterprise application platform 7.2 3.6.1-10.SP9_redhat_00001.1.el8eap
- eap7-undertow jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.0.30-4.SP4_redhat_00001.1.el8eap
- eap7-weld-ejb jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
- eap7-weld-jta jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
- eap7-weld-web jboss enterprise application platform 7.2 3.0.6-4.Final_redhat_00004.1.el8eap
- eap7-hibernate jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 5.3.17-1.Final_redhat_00001.1.el8eap
red hat advisories RHSA-2020:3639RHSA-2020:3638RHSA-2020:3637RHSA-2020:3463RHSA-2020:3462RHSA-2020:3461
- spacecmd Manager Server Module 4.1 4.1.7-4.6.3
- hibernate5 Manager Server Module 4.1 5.3.7-3.3.4
- susemanager Manager Server Module 4.1 4.1.20-3.8.3
- spacewalk-web Manager Server Module 4.1 4.1.18-3.6.3
- hub-xmlrpc-api Manager Server Module 4.1 0.7-3.3.3
- spacewalk-java Manager Server Module 4.1 4.1.20-3.11.8
- spacewalk-utils Manager Server Module 4.1 4.1.12-3.6.3
- susemanager-sls Manager Server Module 4.1 4.1.15-3.8.4
suse advisories SUSE-SU-2020:2832-1SUSE-SU-2020:2650-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-14900 updated cvss 6.5
hibernate: SQL injection issue in Hibernate ORM
-
Red Hat BPM Suite 6 hibernate-core Red Hat Decision Manager 7 hibernate-core-kie-server-ee7 hibernate-core-kie-server-ee7affected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
-
Red Hat JBoss Data Grid 7 hibernate-coreaffected: workaround, no fix available “There is no currently known mitigation for this flaw.”
-
Red Hat JBoss Data Virtualization 6 hibernate-coreaffected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
-
Red Hat OpenStack Platform 10 (Newton) opendaylight Red Hat OpenStack Platform 13 (Queens) opendaylight Red Hat OpenStack Platform 14 (Rocky) opendaylightaffected: workaround, no fix available “There is no currently known mitigation for this flaw.”
-
Red Hat Process Automation 7 hibernate-core-kie-server-ee7 hibernate-core-kie-server-ee7affected: workaround, no fix planned “There is no currently known mitigation for this flaw.”
-
Red Hat EAP-CD 20 Tech Previewfixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3585
-
Red Hat build of Quarkus 1.7.5fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:4252
-
Red Hat Fuse 7.8.0fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:5568
show 11 moreshow fewer
-
Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el6eap, +83 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3637
-
Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el7eap, +85 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3638
-
Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, eap7-weld-jta 3.0.6-4.Final_redhat_00004.1.el8eap, +83 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3639
-
Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el8eap, +75 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3463
-
Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el6eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el6eap, +75 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3461
-
Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-hibernate 5.3.17-1.Final_redhat_00001.1.el7eap, +77 morefixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3462
-
Red Hat JBoss Enterprise Application Platform 7fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:3464
-
Red Hat Single Sign On 7.3.8fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:2112
-
Red Hat RHDM 7.9.0fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:4960
-
Red Hat RHPAM 7.9.0fixed: vendor fix “There is no currently known mitigation for this flaw.” RHSA-2020:4961
-
Red Hat JBoss BRMS 5 hibernate-core Red Hat JBoss Enterprise Application Platform 5 hibernate-core Red Hat JBoss Enterprise Application Platform 6 hibernate-core Red Hat JBoss Enterprise Web Server 2 hibernate4 hibernate4 Red Hat JBoss Fuse 6 hibernate-core Red Hat JBoss Fuse Service Works 6 hibernate-corenot affected: vulnerable code not present
+4 more productsfewer
Red Hat JBoss Operations Network 3 hibernate-core Red Hat Satellite 5 hibernate-core Red Hat Satellite 6 hibernate-core Red Hat Subscription Asset Manager hibernate-core, hibernate4-core
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.hibernate:hibernate-core | <5.3.18 >=5.4.0, <5.4.18 >=5.5.0.Alpha1, <5.5.0.Beta1 |
5.3.18 5.4.18 5.5.0.Beta1 |
Affected products
- n/a Hibernate
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/hibernate/hibernate-orm/commit/3f3c1ab50604ab9ba99e25d2016fb85f3ba9dcd4
web
-
github.com
/hibernate/hibernate-orm/commit/646b383f959eff18d58081b1a574f0d777d353da
web
-
github.com
/hibernate/hibernate-orm/commit/e0e22ea256c1906235d6a8e90b79c4ce33d0861f
web
-
github.com
/hibernate/hibernate-orm/commit/eebf01fbf3c2550ee70cdc9c1b02b52e330c8c36
web
-
bugzilla.redhat.com
/show_bug.cgi?id=1666499
web, issue-tracking, third-party-advisory
-
lists.apache.org
/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E
mailing-list
-
security.netapp.com
/advisory/ntap-20220210-0020/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-14900
advisory
-
github.com
/hibernate/hibernate-orm
package
-
lists.apache.org
/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44@%3Cdev.turbine.apache.org%3E
web
-
security.netapp.com
/advisory/ntap-20220210-0020
web
Sources
- CVE List CVE-2019-14900
- GitHub Advisory GHSA-8grg-q944-cch5
- NVD CVE-2019-14900
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.