NetSight
IP …
medium5.3

CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final.

Impact

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Affected products

VendorProductAffected versions
RedhatHibernate Validator
from 5.0.0 before 6.0.20
from 6.1.2 before 6.1.5
Version 7.0.0
IbmWebsphere Application Server
from 17.0.0.3 through 20.0.0.10
RedhatJboss Enterprise Application Platform
Versions 7.2.0, 7.3.0
RedhatSatellite
Version 6.8
RedhatSatellite Capsule
Version 6.8
QuarkusQuarkus
through 1.4.2
OracleWeblogic Server
Version 14.1.1.0.0

Weakness classification

CWE-20

References