CVE-2019-14900: hibernate hibernate_orm
Vulnerability summary
CVE-2019-14900 is a medium (CVSS 6.5) vulnerability in hibernate hibernate_orm. EPSS estimates a 2.13% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 1Timeline
- 06-07-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.13%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.13% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse23 products
- golang-github-prometheus-node_exporter&distro=SUSE Manager Server Module 4.1< 1.0.1-3.3.4
- golang-github-QubitProducts-exporter_exporter&distro=SUSE Manager Server Module 4.1< 0.4.0-6.9.4
- hibernate5&distro=SUSE Manager Server Module 4.1< 5.3.7-3.3.4
- hub-xmlrpc-api&distro=SUSE Manager Server Module 4.1< 0.7-3.3.3
- patterns-suse-manager&distro=SUSE Manager Server Module 4.1< 4.1-6.6.3
Redhat8 products
- build_of_quarkusna
- decision_manager7.0
- fuse< 7.8.0
- jboss_data_grid7.0.0
- jboss_enterprise_application_platformna | 7.3 | 7.4 | 7.2
Hibernate1 product
- hibernate_orm< 5.3.18 | ≥ 5.4.0, < 5.4.18
Org.hibernate1 product
- hibernate-core< 5.3.18 | ≥ 5.4.0, < 5.4.18 | ≥ 5.5.0.Alpha1, < 5.5.0.Beta1
Quarkus1 product
- quarkus≤ 1.5.2
5 vendors · 34 products
