CVE-2017-7536

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-7536
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7536.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-7536
Aliases
Downstream
Published
2018-01-10T15:29:00.283Z
Modified
2026-03-15T22:18:00.407113Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

References

Affected packages

Git / github.com/hibernate/hibernate-validator

Affected ranges

Type
GIT
Repo
https://github.com/hibernate/hibernate-validator
Events
Introduced
a93f900f0f91bdfccf98a1825d7cfbd85b8a6c85
Fixed
9a8ee4954d9d6596f0bd87fd66d51deac81724d1
Introduced
a3fa9cee819a8e85ab99e8106c434e175b9d5a3b
Fixed
be5f102e7c9eba64e58b93763befde4284ce9e67
Introduced
b9b5ee347e9231271029561ac8cddab00519e484
Fixed
134a5bddddc15559cc8557ef6c91e8d6d7ff3d08
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d805da5686ba8083a858939595347da922c11a8b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7642f2628e411bb0e414ad50ed6d4461d6d0715d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9f35cfaffe42bbf442040172538b54f90be817d8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9f35cfaffe42bbf442040172538b54f90be817d8
Database specific 
{
    "versions": [
        {
            "introduced": "5.2.0"
        },
        {
            "fixed": "5.2.5"
        },
        {
            "introduced": "5.3.0"
        },
        {
            "fixed": "5.3.6"
        },
        {
            "introduced": "5.4.0"
        },
        {
            "fixed": "5.4.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0"
        }
    ]
}

Affected versions

5.*
5.2.0.Final
5.2.1.Final
5.2.2.Final
5.3.0.Alpha1
6.*
6.0.0.Alpha1
6.0.0.Alpha2
6.0.0.Beta1
6.0.0.Beta2
6.0.0.CR1
6.0.0.CR2
6.0.0.CR3
6.0.1.Final
6.0.2.Final
6.0.3.Final
6.0.4.Final
6.0.5.Final
6.0.6.Final
6.0.7.Final
6.0.8.Final
6.0.9.Final
6.1.0.Alpha1
6.1.0.Alpha2
6.1.0.Alpha3
6.1.0.Alpha4
6.1.0.Alpha5
6.1.0.Alpha6
6.1.0.Final
6.1.1.Final
6.1.2.Final
7.*
7.0.0.Alpha1
7.0.0.Alpha2
7.0.0.Alpha3
7.0.0.Alpha4
7.0.0.Alpha5
7.0.0.Alpha6
7.0.0.CR1
7.0.0.Final

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.4.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.1"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7536.json"