CVEvulnerability
CVE-2020-5245
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-02-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.9 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-74
Description
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Affected configurations
• dropwizard dropwizard validation (< 1.3.19)
• dropwizard dropwizard validation (>= 2.0.0 < 2.0.2)
• oracle blockchain platform (< 21.1.2)
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation Third Party Advisory
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions Third Party Advisory
- https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm Third Party Advisory
- https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236 github.com
- https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634 Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3157 Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3160 Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf Exploit, Third Party Advisory
- https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation Third Party Advisory
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions Third Party Advisory
- https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm Third Party Advisory
- https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236 github.com
- https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634 Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3157 Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3160 Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf Exploit, Third Party Advisory