CVE-2020-5245: Remote Code Execution (RCE) vulnerability in dropwizard-validation

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2020-5245

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Source: NVD (National Vulnerability Database)

Vulnerability Description

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Source: NVD (National Vulnerability Database)

Vulnerability Type

输出中的特殊元素转义处理不恰当(注入)

Source: NVD (National Vulnerability Database)

Vulnerability Title

Dropwizard-Validation 注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Dropwizard-Validation 1.3.19之前版本和2.0.2之前版本中的自我验证功能存在注入漏洞。远程攻击者可借助任意Java表达式利用该漏洞在系统上执行任意代码。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dropwizard	dropwizard-validation	>= 1.3.0, < 1.3.19	-

II. Public POCs for CVE-2020-5245

#	POC Description	Source Link	Shenlong Link
1	None	https://github.com/LycsHub/CVE-2020-5245	POC Details

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2020-5245

Please Login to view more intelligence information

https://github.com/dropwizard/dropwizard/pull/3157x_refsource_MISC
https://docs.oracle.com/javaee/7/tutorial/jsf-el.htmx_refsource_MISC
https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolationx_refsource_MISC
https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressionsx_refsource_MISC
https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634x_refsource_MISC
https://github.com/dropwizard/dropwizard/pull/3160x_refsource_MISC
https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfx_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2020-5245

IV. Related Vulnerabilities

Same vendor: dropwizard

CVE-2020-11002
Remote Code Execution (RCE) vulnerability in dropwizard-vali

Same weakness: CWE-74

V. Comments for CVE-2020-5245

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

I. Basic Information for CVE-2020-5245

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2020-5245

III. Intelligence Information for CVE-2020-5245

IV. Related Vulnerabilities

V. Comments for CVE-2020-5245

Leave a comment