GHSA-x83m-pf6f-pf9g

Source

https://github.com/advisories/GHSA-x83m-pf6f-pf9g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-x83m-pf6f-pf9g/GHSA-x83m-pf6f-pf9g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x83m-pf6f-pf9g

Aliases

CVE-2023-1932

Published

2024-11-07T12:30:34Z

Modified

2024-11-07T18:27:12.470464Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

hibernate-validator Cross-site Scripting vulnerability

Details

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

Database specific

{
    "nvd_published_at": "2024-11-07T10:15:04Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-07T18:00:00Z"
}

References

Affected packages

Maven / org.hibernate.validator:hibernate-validator

Package

Name: org.hibernate.validator:hibernate-validator; View open source insights on deps.dev
Purl: pkg:maven/org.hibernate.validator/hibernate-validator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.2.0.Final

Affected versions

6.*

6.0.0.Alpha1

6.0.0.Alpha2

6.0.0.Beta1

6.0.0.Beta2

6.0.0.CR1

6.0.0.CR2

6.0.0.CR3

6.0.0.Final

6.0.1.Final

6.0.2.Final

6.0.3.Final

6.0.4.Final

6.0.5.Final

6.0.6.Final

6.0.7.Final

6.0.8.Final

6.0.9.Final

6.0.10.Final

6.0.11.Final

6.0.12.Final

6.0.13.Final

6.0.14.Final

6.0.15.Final

6.0.16.Final

6.0.17.Final

6.0.18.Final

6.0.19.Final

6.0.20.Final

6.0.21.Final

6.0.22.Final

6.0.23.Final

6.1.0.Alpha1

6.1.0.Alpha2

6.1.0.Alpha3

6.1.0.Alpha4

6.1.0.Alpha5

6.1.0.Alpha6

6.1.0.Final

6.1.1.Final

6.1.2.Final

6.1.3.Final

6.1.4.Final

6.1.5.Final

6.1.6.Final

6.1.7.Final

6.2.0.CR1