CVE-2026-0603

{"id": "CVE-2026-0603", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2026-01-23T07:15:53.660", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:4915", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:4916", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:4917", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:4924", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-0603", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427147", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Hibernate. Un atacante remoto con pocos privilegios podr\u00eda explotar una vulnerabilidad de inyecci\u00f3n SQL de segundo orden al proporcionar caracteres no alfanum\u00e9ricos especialmente dise\u00f1ados y no saneados en la columna ID cuando se utiliza el InlineIdsOrClauseBuilder. Esto podr\u00eda llevar a la revelaci\u00f3n de informaci\u00f3n sensible, como la lectura de archivos del sistema, y permitir la manipulaci\u00f3n o eliminaci\u00f3n de datos dentro de la base de datos de la aplicaci\u00f3n, lo que resultar\u00eda en una denegaci\u00f3n de servicio a nivel de aplicaci\u00f3n."}], "lastModified": "2026-03-18T16:16:24.877", "sourceIdentifier": "secalert@redhat.com"}