CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Link	Resource
https://github.com/dropwizard/dropwizard/pull/3160	Patch Third Party Advisory
https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions	Third Party Advisory
https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634	Patch Third Party Advisory
https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf	Exploit Third Party Advisory
https://github.com/dropwizard/dropwizard/pull/3157	Patch Third Party Advisory
https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation	Third Party Advisory
https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory

Configuration 1

cpe:2.3:a:dropwizard:dropwizard_validation:*:*:*:*:*:*:*:* cpe:2.3:a:dropwizard:dropwizard_validation:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*

---

Published : 2020-02-24 06:15

Updated : 2022-05-12 03:00

---

NVD link : CVE-2020-5245

Mitre link : CVE-2020-5245

No products.

CWE-74