CVE-2020-5245
published 2020-02-24CVE-2020-5245: Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by…
PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
3.09%
86.2th percentile
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libhibernate-validator-java | — | — |
| debian | libhibernate-validator4-java | — | — |
| dropwizard | dropwizard | < 1.3.21 | 1.3.21 |
| dropwizard | dropwizard | — | — |
| dropwizard | dropwizard_validation | < 1.3.19 | 1.3.19 |
| dropwizard | dropwizard_validation | < 1.3.21 | 1.3.21 |
| dropwizard | dropwizard_validation | >= 2.0.0 < 2.0.2 | 2.0.2 |
| dropwizard | dropwizard_validation | >= 2.0.0 < 2.0.3 | 2.0.3 |
| hibernate | hibernate_validator | < 6.2.0 | 6.2.0 |
| hibernate | hibernate_validator | < 7.0.0 | 7.0.0 |
| oracle | blockchain_platform | < 21.1.2 | 21.1.2 |
| redhat | hibernate_validator | < 6.2.0 | 6.2.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
ghsa8.8HIGH
osv8.8HIGH
vendor_oracle8.8HIGH
vendor_debian7.9HIGH
vendor_redhat7.9HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
ghsa·2025-06-03·CVSS 8.8
CVE-2025-35036 [HIGH] CWE-94 Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
OSV
Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
osv·2025-06-03·CVSS 8.8
CVE-2025-35036 [HIGH] Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
OSV
CVE-2025-35036: Hibernate Validator before 6
osv·2025-06-03·CVSS 8.8
CVE-2025-35036 [HIGH] CVE-2025-35036: Hibernate Validator before 6
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
GHSA
Remote Code Execution (RCE) vulnerability in dropwizard-validation
ghsa·2020-04-10·CVSS 8.8
CVE-2020-11002 [HIGH] CWE-74 Remote Code Execution (RCE) vulnerability in dropwizard-validation
Remote Code Execution (RCE) vulnerability in dropwizard-validation
### Summary
A server-side template injection was identified in the self-validating ([`@SelfValidating`](https://javadoc.io/static/io.dropwizard/dropwizard-project/2.0.3/io/dropwizard/validation/selfvalidating/SelfValidating.html)) feature of **dropwizard-validation** enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability.
If you're using a self-validating bean (via [`@SelfValidating`](https://javadoc.io/static/io.dropwizard/dropwizard-project/2.0.3/io/dropwizard/validation/selfvalidating/SelfValidating.html)), an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended.
The changes introduced in Dropwizard 1.3.19 and 2.0.2 (see [GHSA-3mcp-9wr4-cjqf](ht
OSV
Remote Code Execution (RCE) vulnerability in dropwizard-validation
osv·2020-04-10·CVSS 8.8
CVE-2020-11002 [HIGH] Remote Code Execution (RCE) vulnerability in dropwizard-validation
Remote Code Execution (RCE) vulnerability in dropwizard-validation
### Summary
A server-side template injection was identified in the self-validating ([`@SelfValidating`](https://javadoc.io/static/io.dropwizard/dropwizard-project/2.0.3/io/dropwizard/validation/selfvalidating/SelfValidating.html)) feature of **dropwizard-validation** enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability.
If you're using a self-validating bean (via [`@SelfValidating`](https://javadoc.io/static/io.dropwizard/dropwizard-project/2.0.3/io/dropwizard/validation/selfvalidating/SelfValidating.html)), an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended.
The changes introduced in Dropwizard 1.3.19 and 2.0.2 (see [GHSA-3mcp-9wr4-cjqf](ht
OSV
Remote Code Execution (RCE) vulnerability in dropwizard-validation
osv·2020-02-24
CVE-2020-5245 [HIGH] Remote Code Execution (RCE) vulnerability in dropwizard-validation
Remote Code Execution (RCE) vulnerability in dropwizard-validation
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
### Summary
A server-side template injection was identified in the self-validating ([`@SelfValidating`](https://javadoc.io/static/io.dropwizard/dropwizard-project/2.0.2/io/dropwizard/validation/selfvalidating/SelfValidating.html)) feature of **dropwizard-validation** enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability.
If you're using a self-validating bean (via [`@SelfValidating`](https://javadoc.io/static/
GHSA
Remote Code Execution (RCE) vulnerability in dropwizard-validation
ghsa·2020-02-24
CVE-2020-5245 [HIGH] CWE-74 Remote Code Execution (RCE) vulnerability in dropwizard-validation
Remote Code Execution (RCE) vulnerability in dropwizard-validation
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
### Summary
A server-side template injection was identified in the self-validating ([`@SelfValidating`](https://javadoc.io/static/io.dropwizard/dropwizard-project/2.0.2/io/dropwizard/validation/selfvalidating/SelfValidating.html)) feature of **dropwizard-validation** enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability.
If you're using a self-validating bean (via [`@SelfValidating`](https://javadoc.io/static/
Red Hat
hibernate-validator: Hibernate Validator Expression Language Injection
vendor_redhat·2025-06-03·CVSS 7.9
CVE-2025-35036 [HIGH] CWE-94 hibernate-validator: Hibernate Validator Expression Language Injection
hibernate-validator: Hibernate Validator Expression Language Injection
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
A flaw was found in Hibernate Validator. This vulnerability allows unauthorized acces
Debian
CVE-2025-35036: libhibernate-validator-java - Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is u...
vendor_debian·2025·CVSS 7.9
CVE-2025-35036 [HIGH] CVE-2025-35036: libhibernate-validator-java - Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is u...
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Oracle
Oracle Oracle Blockchain Platform Risk Matrix: Backend (Dropwizard-Validation) — CVE-2020-5245
vendor_oracle·2022-04-15·CVSS 8.8
CVE-2020-5245 [HIGH] Oracle Oracle Blockchain Platform Risk Matrix: Backend (Dropwizard-Validation) — CVE-2020-5245
Oracle Oracle Blockchain Platform Risk Matrix: Backend (Dropwizard-Validation) vulnerability
CVE: CVE-2020-5245
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
No detection rules found.
No public exploits indexed.
https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolationhttps://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressionshttps://docs.oracle.com/javaee/7/tutorial/jsf-el.htmhttps://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634https://github.com/dropwizard/dropwizard/pull/3157https://github.com/dropwizard/dropwizard/pull/3160https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfhttps://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolationhttps://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressionshttps://docs.oracle.com/javaee/7/tutorial/jsf-el.htmhttps://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634https://github.com/dropwizard/dropwizard/pull/3157https://github.com/dropwizard/dropwizard/pull/3160https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf
2020-02-24
Published