What’s Vulnerable › Vulnerabilities

CVE-2019-14900

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-06 · updated 2026-06-17
• Weakness: CWE-89

Description

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

Affected products

• Hibernate Orm: before 5.3.18; from 5.4.0 before 5.4.18 — fixed in 5.3.18, 5.4.18
• quarkusio quarkus: through 1.5.2
• Red Hat build of Quarkus: all versions
• RedHat Decision Manager: 7.0
• Red Hat Fuse: before 7.8.0 — fixed in 7.8.0
• RedHat Jboss Data Grid: 7.0.0
• Red Hat JBoss EAP: 7.3, 7.4, 7.2
• RedHat Jboss Middleware Text-Only Advisories: all versions
• OpenStack: 10, 13, 14
• Red Hat Single Sign-On: all versions

How to fix

Upgrade to a fixed version: Hibernate Orm 5.3.18, 5.4.18; Red Hat Fuse 7.8.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1666499
• https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E
• https://security.netapp.com/advisory/ntap-20220210-0020/
• https://bugzilla.redhat.com/show_bug.cgi?id=1666499
• https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E
• https://security.netapp.com/advisory/ntap-20220210-0020/

Get alerted when CVE-2019-14900 or the next vulnerability affects your stack