CVE-2017-7536: In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to…

PriorityP432high7CVSS 3.1

AVLACHPRLUINSUCHIHAH

EPSS

0.48%

38.4th percentile

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	libhibernate-validator-java	< libhibernate-validator-java 4.3.3-4 (bookworm)	libhibernate-validator-java 4.3.3-4 (bookworm)
red_hat_inc	hibernate-validator	—	—
red_hat_inc	hibernate-validator	—	—
red_hat_inc	hibernate-validator	—	—
redhat	hibernate_validator	>= 5.2.0 < 5.2.5	5.2.5
redhat	hibernate_validator	>= 5.3.0 < 5.3.6	5.3.6
redhat	hibernate_validator	>= 5.4.0 < 5.4.2	5.4.2
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_enterprise_application_platform	—	—
redhat	satellite	—	—
redhat	satellite_capsule	—	—
redhat	virtualization	—	—
redhat	virtualization_host	—	—

CVSS provenance

nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P

osv7.0HIGH

vendor_debian7.0HIGH

vendor_redhat7.0HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.