IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.3Hoch

CVE-2026-0603Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

org.hibernate/hibernate-core; Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7; Red Hat Red Hat JBoss Enterprise Application Platform 7… Veröffentlicht: (vor 9 Monaten)

Beschreibung

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Schwachstellentyp (CWE): CWE-89

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
jboss enterprise application platform els 7.4 —
jboss enterprise application platform eus 7.1 —
jboss enterprise application platform eus 7.3 —
Red Hat Red Hat AMQ Broker 7 all versions
Red Hat Red Hat build of OptaPlanner 8 all versions
Red Hat Red Hat Data Grid 8 —
Red Hat Red Hat Fuse 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8 —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat OpenShift AI (RHOAI) —
Red Hat Red Hat OpenShift Dev Spaces —
Red Hat Red Hat Process Automation 7 all versions
Red Hat Red Hat Satellite 6 —
Red Hat Red Hat Single Sign-On 7 all versions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 all versions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 all versions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 all versions
Red Hat Red Hat Single Sign-On 7.6.13 —
Red Hat RHEL-8 based Middleware Containers all versions
red hat single sign on 7.6 —
rhosemc 1.0 —
— org.hibernate/hibernate-core 5.2.8 – ≤ 5.6.15

Referenzen und Patches