FKIE_CVE-2025-35036

Vulnerability from fkie_nvd - Published: 2025-06-03 20:15 - Updated: 2025-09-18 14:19
Severity ?
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
References
9119a7d8-5eab-497f-8521-727c672e3725https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontextProduct
9119a7d8-5eab-497f-8521-727c672e3725https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6ePatch
9119a7d8-5eab-497f-8521-727c672e3725https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1Patch
9119a7d8-5eab-497f-8521-727c672e3725https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78Patch
9119a7d8-5eab-497f-8521-727c672e3725https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893Patch
9119a7d8-5eab-497f-8521-727c672e3725https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.FinalRelease Notes
9119a7d8-5eab-497f-8521-727c672e3725https://github.com/hibernate/hibernate-validator/pull/1138Issue Tracking
9119a7d8-5eab-497f-8521-727c672e3725https://hibernate.atlassian.net/browse/HV-1816Issue Tracking
9119a7d8-5eab-497f-8521-727c672e3725https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1Release Notes
9119a7d8-5eab-497f-8521-727c672e3725https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-languageRelease Notes
9119a7d8-5eab-497f-8521-727c672e3725https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/Not Applicable
9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2020-5245Not Applicable
9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-4428Not Applicable
Impacted products
Vendor Product Version
redhat hibernate_validator *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:hibernate_validator:*:-:*:*:*:*:*:*",
              "matchCriteriaId": "80FD9DDB-71F3-44F1-A033-68CD4ABE3689",
              "versionEndExcluding": "6.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data."
    },
    {
      "lang": "es",
      "value": "Hibernate Validator, en versiones anteriores a la 6.2.0 y la 7.0.0, puede, de forma predeterminada y seg\u00fan su uso, interpolar la informaci\u00f3n proporcionada por el usuario en un mensaje de violaci\u00f3n de restricciones con Expression Language. Esto podr\u00eda permitir a un atacante acceder a informaci\u00f3n confidencial o ejecutar c\u00f3digo Java arbitrario. Hibernate Validator, a partir de la 6.2.0 y la 7.0.0, ya no interpola mensajes personalizados de violaci\u00f3n de restricciones con Expression Language y recomienda encarecidamente no permitir la informaci\u00f3n proporcionada por el usuario en dichos mensajes. CVE-2020-5245 y CVE-2025-4428 son ejemplos de vulnerabilidades relacionadas con la interpolaci\u00f3n de datos proporcionados por el usuario en Expression Language."
    }
  ],
  "id": "CVE-2025-35036",
  "lastModified": "2025-09-18T14:19:46.060",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4,
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-03T20:15:21.993",
  "references": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Product"
      ],
      "url": "https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/hibernate/hibernate-validator/pull/1138"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://hibernate.atlassian.net/browse/HV-1816"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Release Notes"
      ],
      "url": "https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Release Notes"
      ],
      "url": "https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-5245"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4428"
    }
  ],
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.