CVE-2020-5245

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Affected

dropwizard · dropwizard-validation

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

7.9 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

3.01% chance of exploitation in the next 30 days, 87th percentile

Published

2020-02-24

Updated

2024-08-04

Proof-of-concept exploits (1)

• LycsHub/CVE-2020-52450★ · 2023-02-17

Security advisories

• https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation
• https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-inter…
• https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
• dropwizard/dropwizard/pull/3157
• dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf
• advisories/GHSA-3mcp-9wr4-cjqf

References

• CVE Record
• NVD entry

Related

• CVE-2018-18893