High severity · published Feb 24, 2020
CVE-2020-5245
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary…
8.8
CVSS
3%
EPSS
No
On KEV
Description
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Blockchain Platform · Oracle
before 21.1.2 · source: NVD
DV
Dropwizard Validation · Dropwizard
before 1.3.19; 2.0.0 before 2.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5245
Third Party Advisory
https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation
Third Party Advisory
https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions
Third Party Advisory
https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
github.com
https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
Patch
https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634
Patch
https://github.com/dropwizard/dropwizard/pull/3157
More from Dropwizard Validation
8.8
CVE-2020-11002
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability