Lucene search

RedhatCVE-2017-7536

HistoryJan 10, 2018 - 3:29 p.m.

CVE-2017-7536

2018-01-1015:29:00

CWE-470

CWE-592

redhat

web.nvd.nist.gov

113

cve-2017-7536

hibernate validator

security manager

reflective permissions

privilege escalation

nvd

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

28.1%

JSON

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager’s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Affected configurations

Nvd

Vulners

Node

redhathibernate_validatorRange5.2.0–5.2.5

redhathibernate_validatorRange5.3.0–5.3.6

redhathibernate_validatorRange5.4.0–5.4.2

Node

redhatsatelliteMatch6.4

redhatsatellite_capsuleMatch6.4

Node

redhatjboss_enterprise_application_platformMatch6.0.0

redhatjboss_enterprise_application_platformMatch6.4.0

AND

redhatenterprise_linuxMatch5.0

redhatenterprise_linuxMatch6.0

redhatenterprise_linuxMatch7.0

Node

redhatjboss_enterprise_application_platformMatch7.0

redhatjboss_enterprise_application_platformMatch7.1

AND

redhatenterprise_linuxMatch6.0

redhatenterprise_linuxMatch7.0

Node

redhatvirtualizationMatch4.0

redhatvirtualization_hostMatch4.0

AND

redhatenterprise_linuxMatch7.0

VendorProductVersionCPE
redhathibernate_validator*cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*
redhatsatellite6.4cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*
redhatsatellite_capsule6.4cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*
redhatjboss_enterprise_application_platform6.0.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
redhatjboss_enterprise_application_platform6.4.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*
redhatenterprise_linux5.0cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
redhatenterprise_linux6.0cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
redhatjboss_enterprise_application_platform7.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*
redhatjboss_enterprise_application_platform7.1cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	hibernate_validator	*	cpe:2.3:a:redhat:hibernate_validator::::::::
redhat	satellite	6.4	cpe:2.3:a:redhat:satellite:6.4:::::::*
redhat	satellite_capsule	6.4	cpe:2.3:a:redhat:satellite_capsule:6.4:::::::*
redhat	jboss_enterprise_application_platform	6.0.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
redhat	jboss_enterprise_application_platform	6.4.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:::::::*
redhat	enterprise_linux	5.0	cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*
redhat	enterprise_linux	6.0	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	jboss_enterprise_application_platform	7.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:::::::*
redhat	jboss_enterprise_application_platform	7.1	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:::::::*

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "hibernate-validator",
    "vendor": "Red Hat, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "5.2.x before 5.2.5 final"
      },
      {
        "status": "affected",
        "version": "5.3.x"
      },
      {
        "status": "affected",
        "version": "5.4.x"
      }
    ]
  }
]