CVE-2023-1932 — Cross-site Scripting in Hibernate Hibernate-validator

CWE-79 — Cross-site ScriptingCWE-1286 — Improper Validation of Syntactic Correctness of Input8 documents7 sources
Severity
6.1MEDIUMNVD
EPSS
0.8%
top 25.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Hibernate Hibernate-validatorRedhat Codeready StudioRedhat Jboss Enterprise Application Platform+2 more
Timeline
PublishedNov 7

Description

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

🔴Vulnerability Details

4
OSV
hibernate-validator Cross-site Scripting vulnerability↗2024-11-07
▶
GHSA
hibernate-validator Cross-site Scripting vulnerability↗2024-11-07
▶
OSV
CVE-2023-1932: A flaw was found in hibernate-validator's 'isValid' method in the org↗2024-11-07
▶
CVEList
Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss↗2024-11-07
▶

📋Vendor Advisories

2
Red Hat
hibernate-validator: rendering of invalid html with SafeHTML leads to HTML injection and XSS↗2024-02-07
▶
Debian
CVE-2023-1932: libhibernate-validator-java - A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate....↗2023
▶

💬Community

1
Bugzilla
CVE-2023-1932 hibernate-validator: rendering of invalid html with SafeHTML leads to HTML injection and XSS↗2020-03-03
▶