Medium severity · published May 6, 2020
CVE-2020-10693
A flaw was found in Hibernate Validator version 6.1.2.Final
5.3
CVSS
2.4%
EPSS
No
On KEV
Description
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
14.1.1.0.0 · source: NVD
HV
Hibernate Validator · Redhat
5.0.0 before 6.0.20; 6.1.2 before 6.1.5; 7.0.0 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
7.2.0; 7.3.0 · source: NVD
QU
Quarkus · Quarkus
through 1.4.2 · source: NVD
SA
Satellite · Redhat
6.8 · source: NVD
SC
Satellite Capsule · Redhat
6.8 · source: NVD
WA
Websphere Application Server · Ibm
17.0.0.3 through 20.0.0.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10693
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10693
lists.apache.org
https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability