hibernate-validator insecure default Expression Language interpolation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.2.0, 7.0.0, 6.2.0.CR1, 7.0.0.CR1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Hibernate Hibernate Validator
fixed in 6.2.0; fixed in 7.0.0
- org.hibernate.validator:hibernate-validatorMaven
fixed in 6.2.0.CR1
- org.hibernate.validator:hibernate-validatorMaven
From 7.0.0.Alpha1 · fixed in 7.0.0.CR1
- org.hibernate:hibernate-validatorMaven
fixed in 6.2.0.CR1
- org.hibernate:hibernate-validatorMaven
From 7.0.0.Alpha1 · fixed in 7.0.0.CR1