CVEvulnerability

CVE-2017-7536

7.0 HIGH Published 2018-01-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-01-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-470, CWE-592

Description

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Affected configurations

• redhat hibernate validator (>= 5.2.0 < 5.2.5) • redhat hibernate validator (>= 5.3.0 < 5.3.6) • redhat hibernate validator (>= 5.4.0 < 5.4.2) • redhat satellite 6.4 • redhat satellite capsule 6.4 • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 6.4.0 • redhat jboss enterprise application platform 7.0 • redhat jboss enterprise application platform 7.1 • redhat virtualization 4.0 • redhat virtualization host 4.0

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References