Unscored severity · published Sep 30, 2014
CVE-2014-3558
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass…
–
CVSS
2.9%
EPSS
No
On KEV
Description
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HV
Hibernate Validator · Redhat
4.3.0 before 4.3.2; 5.0.0 through 5.0.3; 5.1.0 before 5.1.2; 4.1.0; 4.2.0; 4.2.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3558
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1285.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1286.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1287.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1288.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0125.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.html
More from Hibernate Validator
7.3
CVE-2025-35036
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language
7.0
CVE-2017-7536
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private…
6.1
CVE-2019-10219
A vulnerability was found in Hibernate-Validator
5.3
CVE-2020-10693
A flaw was found in Hibernate Validator version 6.1.2.Final