CVE-2023-1932 Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss
Attackers can bypass SafeHtml validation to inject malicious HTML and execute scripts in user browsers via Hibernate Validator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-1932?
CVE-2023-1932 is a medium-severity cross-site scripting vulnerability in Redhat Jboss Enterprise Application Platform, published on 7 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
Weakness: CWE-79
Which versions are affected by CVE-2023-1932?
4 open source packages ship an affected version, including org.hibernate.validator:hibernate-validator and org.hibernate:hibernate-validator. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
org.hibernate.validator:hibernate-validator Maven | All versions | 6.2.0.Final |
org.hibernate.validator:hibernate-validator Maven | All versions | 6.2.0.Final |
org.hibernate:hibernate-validator Maven | All versions | 6.2.0.Final |
org.hibernate:hibernate-validator Maven | All versions | 6.2.0.Final |
Products include Hibernate Hibernate-Validator, Redhat Codeready Studio, Redhat Jboss Enterprise Application Platform, Redhat Openstack Platform, Redhat Single Sign-On.
How do I fix CVE-2023-1932?
Upgrade org.hibernate.validator:hibernate-validator to 6.2.0.Final or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-1932 being exploited?
There is no known exploitation of CVE-2023-1932 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1792693332, DEBIAN-CVE-2023-1932, GHSA-x83m-pf6f-pf9g, UBUNTU-CVE-2023-1932.