CVE-2020-10693 Improper Input Validation in Hibernate Validator
Attackers can execute arbitrary code by bypassing input sanitation in Hibernate Validator error messages via invalid EL expressions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10693?
CVE-2020-10693 is a medium-severity code injection vulnerability in Ibm Websphere Application Server, published on 6 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
Weakness: CWE-20
Which versions are affected by CVE-2020-10693?
8 open source packages ship an affected version, including org.hibernate.validator:hibernate-validator and org.hibernate:hibernate-validator. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
org.hibernate.validator:hibernate-validator Maven | All versions | 6.0.20.Final |
org.hibernate.validator:hibernate-validator Maven | All versions | 6.0.20.Final |
org.hibernate.validator:hibernate-validator Maven | From 6.1.0.Final | 6.1.5.Final |
org.hibernate.validator:hibernate-validator Maven | From 6.1.0.Final | 6.1.5.Final |
org.hibernate:hibernate-validator Maven | All versions | 6.0.20.Final |
org.hibernate:hibernate-validator Maven | All versions | 6.0.20.Final |
2 more packages
org.hibernate:hibernate-validator Maven | From 6.1.0.Final | 6.1.5.Final |
org.hibernate:hibernate-validator Maven | From 6.1.0.Final | 6.1.5.Final |
Products include Ibm Websphere Application Server, Oracle Weblogic Server, Quarkus Quarkus, Redhat Hibernate Validator, Redhat Jboss Enterprise Application Platform, Redhat Satellite and 1 more.
How do I fix CVE-2020-10693?
Upgrade org.hibernate.validator:hibernate-validator to a fixed version for your release line: 6.0.20.Final or 6.1.5.Final.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-10693 being exploited?
There is no known exploitation of CVE-2020-10693 in the wild and no public exploit code.
Other vulnerabilities in Ibm Websphere Application Server
Sources
Also known as CLSA-2026-1770682156, CLSA-2026-1791220396, DEBIAN-CVE-2020-10693, GHSA-rmrm-75hp-phr2, OESA-2021-1138, UBUNTU-CVE-2020-10693.