GitHub Advisoryadvisory · Maven

GHSA-m8p2-495h-ccmh The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

MEDIUM Published 2020-01-08 Modified 2025-09-12 Official page ↗
Aliases
CVE-2019-10219
Ecosystem
Maven
Packages
org.hibernate.validator:hibernate-validator, org.hibernate:hibernate-validator
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-01-08

Affected packages

• Maven org.hibernate.validator:hibernate-validator: >= 6.1.0.Alpha1, < 6.1.0.Alpha6 → fixed in 6.1.0.Alpha6 • Maven org.hibernate.validator:hibernate-validator: >= 6.0.0.Alpha1, < 6.0.18.Final → fixed in 6.0.18.Final • Maven org.hibernate:hibernate-validator: >= 6.1.0.Alpha1, < 6.1.0.Alpha6 → fixed in 6.1.0.Alpha6 • Maven org.hibernate:hibernate-validator: >= 6.0.0.Alpha1, < 6.0.18.Final → fixed in 6.0.18.Final

Description

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Related

Alias · CVE (1)

  • CVE-2019-10219 A vulnerability was found in Hibernate-Validator. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References