IBM has announced a release for IBM Security Identity Governance and Intelligence (IGI) in response to security vulnerability. The vulnerability affects the Hibernate Validator library used by WebSphere Application Server Liberty. If exploited an attacker could bypass input sanitation controls when handling user-controlled data in error messages.
CVEID:CVE-2020-10693
**DESCRIPTION:**Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message interpolation processor. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass input sanitation controls when handling user-controlled data in error messages.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/182240 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Security Identity Governance and Intelligence | 5.2.6 |
Product Name | VRMF | First Fix |
---|---|---|
IGI | 5.2.6 | 10.0.0.0-ISS-ISVG-IGVA-FP0000 |
None