~ / search / GHSA-m8p2-495h-ccmh

GHSA-m8p2-495h-ccmh

The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10219

Packages

EcosystemPackageAffectedFixed in
Maven org.hibernate.validator:hibernate-validator >= 6.1.0.Alpha1, < 6.1.0.Alpha6 6.1.0.Alpha6
Maven org.hibernate.validator:hibernate-validator >= 6.0.0.Alpha1, < 6.0.18.Final 6.0.18.Final
Maven org.hibernate:hibernate-validator >= 6.1.0.Alpha1, < 6.1.0.Alpha6 6.1.0.Alpha6
Maven org.hibernate:hibernate-validator >= 6.0.0.Alpha1, < 6.0.18.Final 6.0.18.Final

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

References

External links from the advisory. They lead to third-party sites.