ghsa-m8p2-495h-ccmh
Vulnerability from github
Published
2020-01-08 17:01
Modified
2024-05-15 05:32
Severity ?
Summary
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
Details
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.hibernate.validator:hibernate-validator" }, "ranges": [ { "events": [ { "introduced": "6.1.0.Alpha1" }, { "fixed": "6.1.0.Alpha6" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2019-10219" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2020-01-08T17:00:14Z", "nvd_published_at": "2019-11-08T15:15:00Z", "severity": "MODERATE" }, "details": "A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.", "id": "GHSA-m8p2-495h-ccmh", "modified": "2024-05-15T05:32:26Z", "published": "2020-01-08T17:01:52Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10219" }, { "type": "WEB", "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee" }, { "type": "WEB", "url": "https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220210-0024" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a@%3Cpluto-dev.portals.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c@%3Cpluto-dev.portals.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4@%3Cpluto-scm.portals.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d@%3Cnotifications.accumulo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6@%3Cnotifications.accumulo.apache.org%3E" }, { "type": "PACKAGE", "url": "https://github.com/hibernate/hibernate-validator" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0445" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0164" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0161" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0160" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0159" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks" }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.