CVE-2019-14900: 
Java vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2019-14900) was discovered in Hibernate ORM versions before 5.3.18, 5.4.18, and 5.5.0.Beta1. The vulnerability exists in the implementation of the JPA Criteria API, where unsanitized literals can be permitted when used in the SELECT or GROUP BY parts of the query. The vulnerability was discovered by Guillaume Smet from Red Hat and was first reported on January 15, 2019 (Red Hat Bugzilla).

The vulnerability is classified as a SQL injection flaw (CWE-89) with a CVSS v3.1 base score of 6.5 (MEDIUM), and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue specifically affects the JPA Criteria API implementation where unsanitized literals in SELECT or GROUP BY query parts could lead to SQL injection (NVD).

When successfully exploited, this vulnerability could allow an attacker to access unauthorized information or potentially conduct further attacks. The vulnerability primarily affects the confidentiality of the system, with no direct impact on integrity or availability (NVD, NetApp Advisory).

The vulnerability has been fixed in Hibernate ORM versions 5.3.18, 5.4.18, and 5.5.0.Beta1. Users are advised to upgrade to these versions or later to address the vulnerability. Initially, there were no known mitigations for this flaw other than upgrading to the fixed versions (Red Hat Bugzilla).