CVE-2019-10219 The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
Attackers can execute arbitrary scripts via unsanitized HTML comments in Hibernate Validator, requiring library upgrades to mitigate XSS risks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10219?
CVE-2019-10219 is a medium-severity cross-site scripting vulnerability in Netapp Active Iq Unified Manager, published on 8 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
Weakness: CWE-79
Which versions are affected by CVE-2019-10219?
8 open source packages ship an affected version, including org.hibernate.validator:hibernate-validator and org.hibernate:hibernate-validator. It affects 187 products.
| Package | Affected | Fixed in |
|---|---|---|
org.hibernate.validator:hibernate-validator Maven | From 6.0.0.Alpha1 | 6.0.18.Final |
org.hibernate.validator:hibernate-validator Maven | From 6.0.0.Alpha1 | 6.0.18.Final |
org.hibernate.validator:hibernate-validator Maven | From 6.1.0.Alpha1 | 6.1.0.Alpha6 |
org.hibernate.validator:hibernate-validator Maven | From 6.1.0.Alpha1 | 6.1.0.Alpha6 |
org.hibernate:hibernate-validator Maven | From 6.0.0.Alpha1 | 6.0.18.Final |
org.hibernate:hibernate-validator Maven | From 6.0.0.Alpha1 | 6.0.18.Final |
2 more packages
org.hibernate:hibernate-validator Maven | From 6.1.0.Alpha1 | 6.1.0.Alpha6 |
org.hibernate:hibernate-validator Maven | From 6.1.0.Alpha1 | 6.1.0.Alpha6 |
Products include Netapp Active Iq Unified Manager, Netapp Element, Netapp Management Services for Element Software and Netapp Hci, Netapp Snapcenter Plug-In, Oracle Access Manager, Oracle Agile Engineering Data Management and 181 more.
How do I fix CVE-2019-10219?
Upgrade org.hibernate.validator:hibernate-validator to a fixed version for your release line: 6.0.18.Final or 6.1.0.Alpha6.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-10219 being exploited?
There is no known exploitation of CVE-2019-10219 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Netapp Active Iq Unified Manager
Sources
Also known as CLSA-2026-1778028250, CLSA-2026-1789376980, DEBIAN-CVE-2019-10219, GHSA-m8p2-495h-ccmh, OESA-2021-1332, UBUNTU-CVE-2019-10219.