CoreCVE
Back

MEDIUM

hibernate-validator: Improper input validation in the interpolation of constraint error messages

Published May 6, 2020

Description

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Affected products

Remediation

Red Hat statement

hibernate-validator is packaged with Red Hat OpenStack Platform 13.0's OpenDaylight (ODL). However, because ODL is technical preview in this version and the flaw is moderate, Red Hat will not be releasing a fix for the OpenStack package at this time.

Red Hat mitigation

You can pass user input as an expression variable by unwrapping the context to HibernateConstraintValidatorContext. Please refer to the https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/ and https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code.

Weaknesses (1)

CWE-20

Improper Input Validation

References (14)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published May 6, 2020
Updated Aug 4, 2024
Reserved Mar 20, 2020
Link CVE-2020-10693
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-10693
Red Hat
Severity Moderate
Public date May 5, 2020
Links CVE-2020-10693 - Bugzilla
GHSA-RMRM-75HP-PHR2