CVE-2019-10219GHSA-M8P2-495H-CCMH
A vulnerability was found in Hibernate-Validator.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.0.Alpha6, 6.0.18.Final
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Hibernate hibernate-validator
From 6.0.0.Alpha1 · through 6.0.17.Final; From 6.1.0.Alpha1 · through 6.1.0.Alpha6
- org.hibernate.validator:hibernate-validatorMaven
From 6.1.0.Alpha1 · fixed in 6.1.0.Alpha6
- org.hibernate.validator:hibernate-validatorMaven
From 6.0.0.Alpha1 · fixed in 6.0.18.Final
- org.hibernate:hibernate-validatorMaven
From 6.1.0.Alpha1 · fixed in 6.1.0.Alpha6
- org.hibernate:hibernate-validatorMaven
From 6.0.0.Alpha1 · fixed in 6.0.18.Final
References 18
lists.apache.org
- thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@<notifications.accumulo.apache.org>
- thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6@<notifications.accumulo.apache.org>
- thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d@<notifications.accumulo.apache.org>
- thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a@<pluto-dev.portals.apache.org>
- thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c@<pluto-dev.portals.apache.org>
- thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4@<pluto-scm.portals.apache.org>