CVE-2020-25638

Опубликовано: 02 дек. 2020

Источник: nvd

CVSS3: 7.4

CVSS2: 5.8

EPSS Низкий

Описание

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1881353
Issue Tracking
Third Party Advisory
https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E
https://lists.apache.org/thread.html/rf2378209c676a28b71f9b604a3b3517c448540b85367160e558ef9df%40%3Ccommits.turbine.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/01/msg00000.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2021/dsa-4908
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1881353
Issue Tracking
Third Party Advisory
https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E
https://lists.apache.org/thread.html/rf2378209c676a28b71f9b604a3b3517c448540b85367160e558ef9df%40%3Ccommits.turbine.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/01/msg00000.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2021/dsa-4908
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hibernate:hibernate_orm:*:*:*:*:*:*:*:*

Версия до 5.3.20 (исключая)

cpe:2.3:a:hibernate:hibernate_orm:*:*:*:*:*:*:*:*

Версия от 5.4.0 (включая) до 5.4.24 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

Версия до 1.9.2 (включая)

Конфигурация 4

Одно из

cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00519

Низкий

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2020-25638

CVSS3: 7.4

ubuntu

около 5 лет назад

CVE-2020-25638

CVSS3: 7.4

redhat

больше 5 лет назад

CVE-2020-25638

CVSS3: 7.4

debian

около 5 лет назад

A flaw was found in hibernate-core in versions prior to and including ...

GHSA-j8jw-g6fq-mp7h

CVSS3: 7.4

github

почти 4 года назад

SQL injection in hibernate-core

BDU:2022-00307

CVSS3: 7.4

fstec

больше 5 лет назад

Уязвимость интерфейса API JPA Criteria службы запросов Hibernate ORM, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность

EPSS

Процентиль: 66%

0.00519

Низкий

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-89