CVE-2020-25638: 
Java vulnerability analysis and mitigation

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection vulnerability exists in the implementation of the JPA Criteria API that can permit unsanitized literals when a literal is used in the SQL comments of the query (NVD, Red Hat Bugzilla).

The vulnerability is tracked as CVE-2020-25638 with a CVSS v3.1 Base Score of 7.4 (High). The attack vector is Network-based with High attack complexity, requiring no privileges or user interaction. The scope is Unchanged with High impact on both Confidentiality and Integrity but no impact on Availability (NVD).

This vulnerability could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity, as it could enable unauthorized data retrieval, updates, or deletion if the attacker has knowledge of table and column names (Red Hat Bugzilla).

As a mitigation, users can set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. For permanent remediation, users should upgrade to versions after 5.4.23.Final (Red Hat Bugzilla).