CVE-2020-11002 — Injection in Dropwizard

CWE-74 — Injection4 documents4 sources
Severity
8.8HIGHNVD
CNA8.0
EPSS
1.3%
top 20.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
DropwizardDropwizard Validation
Timeline
PublishedApr 10

Description

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDdropwizard/dropwizard_validation2.0.0 — 2.0.3+1
▶CVEListV5dropwizard/dropwizard< 1.3.21+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Remote Code Execution (RCE) vulnerability in dropwizard-validation↗2020-04-10
▶
CVEList
Remote Code Execution (RCE) vulnerability in dropwizard-validation↗2020-04-10
▶
OSV
Remote Code Execution (RCE) vulnerability in dropwizard-validation↗2020-04-10
▶
CVE-2020-11002 — Injection in Dropwizard | cvebase