CVE & CISA-KEV Catalog

CVE-2020-25638

HIGHEPSS 85th pctl

7.4

CVSS v3

Description

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CWE-89SQL Injection

How to fix

Remediation Available

libhibernate3-javaDebian

Fixed in:3.6.10.Final-11CVE-2020-25638

Fixed in:3.6.10.Final-11CVE-2020-25638

Fixed in:3.6.10.Final-11CVE-2020-25638

Fixed in:3.6.10.Final-11CVE-2020-25638

eap7-glassfish-elRocky

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-elRed Hat / RHEL

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-el-implRed Hat / RHEL

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-el-implRocky

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-hibernateRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernateRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-coreRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-coreRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-entitymanagerRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-entitymanagerRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-enversRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-enversRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-infinispanRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-infinispanRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-java8Red Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-java8Rocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-jackson-databindRocky

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-jackson-databindRed Hat / RHEL

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-jboss-ejb-clientRocky

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-jboss-ejb-clientRed Hat / RHEL

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-nettyRocky

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-nettyRed Hat / RHEL

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-netty-allRocky

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-netty-allRed Hat / RHEL

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-undertowRed Hat / RHEL

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-undertowRocky

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildflyRocky

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildflyRed Hat / RHEL

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-elytronRocky

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-elytronRed Hat / RHEL

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-client-commonRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-client-commonRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-ejb-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-ejb-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-naming-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-naming-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-transaction-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-transaction-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-modulesRocky

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-modulesRed Hat / RHEL

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-naming-clientRocky

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-naming-clientRed Hat / RHEL

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-opensslRed Hat / RHEL

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-opensslRocky

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-javaRocky

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-javaRed Hat / RHEL

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linuxRed Hat / RHEL

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linuxRocky

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linux-debuginfoRocky

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linux-debuginfoRed Hat / RHEL

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploit Intelligence

2.91%probability of exploitation in 30 days

85thpercentile

Elevated risk: more likely to be exploited than 85% of all known CVEs.

References

Patch3

Third-Party Advisory3

Other references2

Related Vulnerabilities

Other CWE-89 (SQL Injection) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2014-3704	High	7.5	100%	-	Fix
CVE-2015-7297	High	7.5	100%	-	-
CVE-2024-29824	High	8.8	100%	KEV	Fix
CVE-2023-34362	Critical	9.8	100%	KEV + Ransom	Fix
CVE-2019-7481	High	7.5	100%	KEV + Ransom	Fix
CVE-2024-29826	High	8.8	100%	-	Fix

Embed a live status badge for CVE-2020-25638

Markdown

[![CVE-2020-25638](https://tridentstack.com/cve/badge/CVE-2020-25638.svg)](https://tridentstack.com/cve/CVE-2020-25638)

HTML

<a href="https://tridentstack.com/cve/CVE-2020-25638"><img src="https://tridentstack.com/cve/badge/CVE-2020-25638.svg" alt="CVE-2020-25638"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-04-23.