Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.0

Hibernate Validator can access sensitive data due to misconfigured security settings

CVE-2017-7536 · published 8 years ago
Summary

A bug in Hibernate Validator allows an attacker to access private data if the security settings are not properly configured. This could potentially be exploited to manipulate or access sensitive information. To fix this issue, update to Hibernate Validator version 5.2.5 or later.

What to do
  • Update hibernate org.hibernate:hibernate-validator to version 5.2.5.Final.
  • Update hibernate org.hibernate:hibernate-validator to version 5.3.6.Final.
  • Update hibernate org.hibernate:hibernate-validator to version 5.4.2.Final.
Affected software
Ecosystem VendorProductAffected versions
maven hibernate org.hibernate:hibernate-validator >= 5.2.0, <= 5.2.4.Final
>= 5.3.0, <= 5.3.5.Final
>= 5.4.0, <= 5.4.1.Final
Fix: upgrade to 5.2.5.Final
– redhat hibernate_validator >= 5.2.0, < 5.2.5
>= 5.3.0, < 5.3.6
>= 5.4.0, < 5.4.2
cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*
– redhat satellite 6.4
cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*
– redhat satellite_capsule 6.4
cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*
– redhat jboss_enterprise_application_platform 6.0.0
6.4.0
7.0
7.1
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
– redhat virtualization 4.0
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
– redhat virtualization_host 4.0
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
Original advisory text
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, ...
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-592DEPRECATED: Authentication Bypass Issues
Timeline
Published10 Jan 2018
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-xxgp-pcfc-3vgc · GHSA
CVE-2017-7536 · NVD
Track software like this
Free during beta