mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
125 lines
5.0 KiB
JSON
125 lines
5.0 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2020-5245",
|
|
"ASSIGNER": "security-advisories@github.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.\n\nThe issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
|
|
"cweId": "CWE-74"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "dropwizard",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "dropwizard-validation",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": ">= 1.3.0, < 1.3.19"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": ">= 2.0.0, < 2.0.2"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf"
|
|
},
|
|
{
|
|
"url": "https://github.com/dropwizard/dropwizard/pull/3157",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/dropwizard/dropwizard/pull/3157"
|
|
},
|
|
{
|
|
"url": "https://github.com/dropwizard/dropwizard/pull/3160",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/dropwizard/dropwizard/pull/3160"
|
|
},
|
|
{
|
|
"url": "https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236"
|
|
},
|
|
{
|
|
"url": "https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634"
|
|
},
|
|
{
|
|
"url": "https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation",
|
|
"refsource": "MISC",
|
|
"name": "https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation"
|
|
},
|
|
{
|
|
"url": "https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions",
|
|
"refsource": "MISC",
|
|
"name": "https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions"
|
|
},
|
|
{
|
|
"url": "https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm",
|
|
"refsource": "MISC",
|
|
"name": "https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm"
|
|
}
|
|
]
|
|
},
|
|
"source": {
|
|
"advisory": "GHSA-3mcp-9wr4-cjqf",
|
|
"discovery": "UNKNOWN"
|
|
},
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 7.9,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"scope": "CHANGED",
|
|
"userInteraction": "REQUIRED",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |