Hibernate hibernate-validator
At a glance
- Source
- NVD
- EPSS
- EPSS 2.16 % · percentile 82 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
- https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/errata/RHSA-2020:0161
- https://access.redhat.com/errata/RHSA-2020:0445
- https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe
- https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee
- https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219
- https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219
- https://security.netapp.com/advisory/ntap-20220210-0024/
- https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | redhat |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | MEDIUM 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-m8p2-495h-ccmh — The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
European references
- ENISA EUVD · EUVD-2020-0269
- GCVE · GCVE-0-2019-10219
CERT-FR advisories
- CERTFR-2023-AVI-0648 — Multiples vulnérabilités dans les produits NetApp · cert.ssi.gouv.fr
- CERTFR-2022-AVI-056 — Multiples vulnérabilités dans Oracle WebLogic Server · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*< 6.0.18cpe:2.3:a:redhat:hibernate_validator:6.1.0:alpha1:*:*:*:*:*:*cpe:2.3:a:redhat:hibernate_validator:6.1.0:alpha2:*:*:*:*:*:*cpe:2.3:a:redhat:hibernate_validator:6.1.0:alpha3:*:*:*:*:*:*cpe:2.3:a:redhat:hibernate_validator:6.1.0:alpha4:*:*:*:*:*:*cpe:2.3:a:redhat:hibernate_validator:6.1.0:alpha5:*:*:*:*:*:*cpe:2.3:a:redhat:hibernate_validator:6.1.0:alpha6:*:*:*:*:*:*cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:*cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*cpe:2.3:a:oracle:airlines_data_model:12.1.1.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:airlines_data_model:12.2.0.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_express:21.1.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_performance_management:13.4.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_performance_management:13.5.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:argus_analytics:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:argus_analytics:8.2.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:argus_analytics:8.2.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:argus_analytics:8.21:*:*:*:*:*:*:*cpe:2.3:a:oracle:argus_insight:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:argus_insight:8.2.2:*:*:*:*:*:*:*- +380 more
Affected products
| Product | Versions |
|---|---|
| Hibernate · hibernate-validator | affected 6.0.0.Alpha1 ≤ 6.0.17.Final ; affected 6.1.0.Alpha1 ≤ 6.1.0.Alpha6 ; unaffected 6.0.18.Final ≤ 6.0.* ; unaffected 6.1.0.Final ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |