SQL Injection in Hibernate ORM
Moderate severity
GitHub Reviewed
Published
Feb 10, 2022
to the GitHub Advisory Database
•
Updated Jun 27, 2024
Package
Affected versions
< 5.3.18
>= 5.4.0, < 5.4.18
>= 5.5.0.Alpha1, < 5.5.0.Beta1
Patched versions
5.3.18
5.4.18
5.5.0.Beta1
Description
Published by the National Vulnerability Database
Jul 6, 2020
Reviewed
May 11, 2021
Published to the GitHub Advisory Database
Feb 10, 2022
Last updated
Jun 27, 2024
Credits
-
mpihelgas Analyst
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
References