Log in Start free

Vulnerability · Published Nov 7, 2024 · Assigned by redhat

CVE-2023-1932Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss

Medium 6.1

In plain English

A medium-severity cross-site scripting in A-MQ Clients 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 57.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libhibernate-validator-javano fix listedDEBIAN-CVE-2023-1932
Debian:13libhibernate-validator-javano fix listedDEBIAN-CVE-2023-1932
Debian:14libhibernate-validator-javano fix listedDEBIAN-CVE-2023-1932
Mavenorg.hibernate.validator:hibernate-validator6.2.0.FinalGHSA-x83m-pf6f-pf9g
Mavenorg.hibernate:hibernate-validator6.2.0.FinalGHSA-x83m-pf6f-pf9g
Ubuntu:22.04:LTSlibhibernate-validator-javano fix listedUBUNTU-CVE-2023-1932
Ubuntu:24.04:LTSlibhibernate-validator-javano fix listedUBUNTU-CVE-2023-1932
Ubuntu:25.10libhibernate-validator-javano fix listedUBUNTU-CVE-2023-1932
Ubuntu:26.04:LTSlibhibernate-validator-javano fix listedUBUNTU-CVE-2023-1932
Ubuntu:26.10libhibernate-validator-javano fix listedUBUNTU-CVE-2023-1932

Affected products (as reported)

VendorProductVersions
Red Hat A-MQ Clients 2 see references
Red Hat Cryostat 2 see references
Red Hat Red Hat AMQ Broker 7 see references
Red Hat Red Hat A-MQ Online see references
Red Hat Red Hat BPM Suite 6 see references
Red Hat Red Hat CodeReady Studio 12 see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Decision Manager 7 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat JBoss BRMS 5 see references
Red Hat Red Hat JBoss Data Grid 7 see references
Red Hat Red Hat JBoss Data Virtualization 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 5 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform Continuous Delivery see references
Red Hat Red Hat JBoss Fuse 6 see references
Red Hat Red Hat JBoss Fuse Service Works 6 see references
Red Hat Red Hat JBoss Operations Network 3 see references
Red Hat Red Hat JBoss SOA Platform 5 see references
Red Hat Red Hat OpenStack Platform 10 (Newton) see references
Red Hat Red Hat OpenStack Platform 13 (Queens) see references
Red Hat Red Hat Process Automation 7 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Single Sign-On 7 see references
Red Hat Red Hat support for Spring Boot see references
Red Hat streams for Apache Kafka see references

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References