CVE-2014-3558

CWE-264CWE-287 — Improper AuthenticationCWE-2669 documents7 sources
Severity
5.0MEDIUM
EPSS
0.5%
top 32.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Hibernate Validator
Timeline
PublishedSep 30
Latest updateMay 14

Description

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶Debianlibhibernate-validator-java< 4.2.1-2+3
▶NVDredhat/hibernate_validator4.3.0 — 4.3.2+4
▶Mavenorg.hibernate:hibernate-validator4.1.0 — 4.2.1+2

🔴Vulnerability Details

4
GHSA
Improper Authentication in Hibernate Validator↗2022-05-14
▶
OSV
Improper Authentication in Hibernate Validator↗2022-05-14
▶
CVEList
CVE-2014-3558: ReflectionHelper (org↗2014-09-30
▶
OSV
CVE-2014-3558: ReflectionHelper (org↗2014-09-30
▶

📋Vendor Advisories

2
Red Hat
Validator: JSM bypass via ReflectionHelper↗2014-07-16
▶
Debian
CVE-2014-3558: libhibernate-validator-java - ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Va...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-3558 Hibernate Validator: JSM bypass via ReflectionHelper↗2014-07-17
▶
Bugzilla
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via ReflectionHelper [fedora-all]↗2014-07-17
▶