SQL Injection Defense Vulnerability in libowasp-esapi-java: Improper Neutralization of Special Elements
Summary
CVE-2025-5878: A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. Affects libowasp-esapi-java across 4 version ranges.
< 0fa4c0f1311aa525b1a776f0a789fb1dc8a04b41
< 2.4.0.0-0+deb11u1
< e2322914304d9b1c52523ff24be495b7832f6a56
< f75ac2c2647a81d2cfbdc9c899f8719c240ed512
Fixed in 2.4.0.0-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libowasp-esapi-java is a library that provides a set of security controls for Java applications, including encoding and decoding functions to prevent various types of attacks. It is widely used for its Encoder.encodeForSQL function, which is intended to defend against SQL injection attacks. However, a vulnerability has been identified that compromises this defense mechanism, allowing attackers to exploit the system.
Vulnerability Detail
A vulnerability was discovered in the Encoder.encodeForSQL function of the libowasp-esapi-java package, classified as problematic. This issue stems from improper neutralization of special elements, which can lead to SQL injection attacks. The vulnerability can be exploited remotely, and an exploit has been publicly disclosed. The severity of this vulnerability is reflected in its CVSS score of 7.3, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
2.4.0.0-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libowasp-esapi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the Encoder.encodeForSQL function until the package is updated. Additionally, any attempts to use this function in the current version will trigger a warning, alerting users to the risks involved.
Conclusion
The vulnerability in the libowasp-esapi-java package poses a significant risk due to its potential for SQL injection attacks. Users are strongly advised to upgrade to the patched version 2.7.0.0 to mitigate this risk. Temporary workarounds are available, but the best course of action is to implement the recommended updates.
See every vulnerability recorded for libowasp-esapi-java →
FAQ
The vulnerability involves improper neutralization of special elements in the Encoder.encodeForSQL function, which can lead to SQL injection attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
If an immediate upgrade is not possible, avoid using the Encoder.encodeForSQL function and monitor for any updates regarding the vulnerability.
For more information, you can refer to the official documentation of libowasp-esapi-java or contact the maintainers of the project.
References
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-esapi-java.
