CVE-2020-25638 in WebLogic Server

Zusammenfassung (Englisch)

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservieren

16.09.2020

Veröffentlichung

02.12.2020

Status

Bestätigt

Einträge

VulDB provides additional information and datapoints for this CVE:

ID	Schwachstelle	CWE	Aus	Mas	CVE
226557	Oracle WebLogic Server Core SQL Injection	89	Nicht definiert	Offizieller Fix	CVE-2020-25638
197835	Oracle Communications Cloud Native Core Console CNC Console SQL Injection	89	Nicht definiert	Offizieller Fix	CVE-2020-25638
179228	Oracle Retail Customer Management and Segmentation Foundation Hibernate SQL Injection	89	Nicht definiert	Offizieller Fix	CVE-2020-25638
165532	hibernate-core JPA Criteria API SQL Injection	89	Nicht definiert	Offizieller Fix	CVE-2020-25638

Quellen

• MITRE
• NVD
• CVE Details