Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

CVE-2026-0603

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

HIGH 8.3

En bref

Source
NVD
EPSS
EPSS 1.03 % · centile 64 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Deferred

Description

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lredhat
CVSS 3.1HIGH 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lredhat-SADP
CVSS 3.1HIGH 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LNVD · secalert@redhat.com (Secondary)
CVSS 3.1HIGH 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LNVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Avis

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
org.hibernate/hibernate-coreaffected 5.2.8 ≤ 5.6.15
Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7unaffected 0:5.1.17-4.Final_redhat_00005.1.ep7.el7 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7unaffected 0:7.1.14-4.GA_redhat_00003.1.ep7.el7 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7unaffected 0:5.3.38-1.Final_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7unaffected 0:7.3.17-5.GA_redhat_00006.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4.24unaffected 5.3.38.Final-redhat-00001 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7unaffected 0:5.3.38-1.Final_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7unaffected 0:7.4.24-4.GA_redhat_00002.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8unaffected 0:5.3.38-1.Final_redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8unaffected 0:7.4.24-4.GA_redhat_00002.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9unaffected 0:5.3.38-1.Final_redhat_00001.1.el9eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9unaffected 0:7.4.24-4.GA_redhat_00002.1.el9eap < *
Red Hat · Red Hat Single Sign-On 7.6.13
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.20-1.redhat_00001.1.el7sso < *
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.20-1.redhat_00001.1.el8sso < *
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.20-1.redhat_00001.1.el9sso < *
Red Hat · RHEL-8 based Middleware Containersunaffected 7.6-85 < *
Red Hat · Red Hat AMQ Broker 7
Red Hat · Red Hat build of OptaPlanner 8
Red Hat · Red Hat Data Grid 8

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD