CVE-2020-11002

CVE-2020-11002 affects Dropwizard-validation prior to 1.3.21 and 2.0.3, where a server-side template injection in the self-validating feature enables injection of arbitrary Java EL expressions, leading to Remote Code Execution (RCE). Affected: dropwizard-validation versions before 1.3.21 and 2.0....

Server-Side Template Injection

dropwizard-validation is vulnerable to server-side template injection. The vulnerability exists as ViolationCollector does not sanitize Java Expression Language EL expressions and accepts malicious Java EL expressions to be passed into the server-side template in the self-validating feature,...

Dropwizard-Validation Injection Vulnerability

Dropwizard is a Java framework for the development of easy to operate , high-performance RESTful web services . An injection vulnerability exists in Dropwizard-Validation versions prior to 1.3.19 and prior to 2.0.2. The vulnerability arises when a web system or product lacks proper validation of...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

Security feature bypass

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245

Technical specifics for CVE-2020-5245 (affected software, root cause, impact, and fix) are provided in the Initial document; there are no additional concrete details about this CVE in the Connected documents.

com.expediagroup.dropwizard:dropwizard-resilience4j-bundle (>=3.0.0 <=3.1.0), com.expediagroup.dropwizard:dropwizard-template-config (=2.0.0) +152 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=2.0.0 <=2.0.19)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =3.0.0, =3.0.0, =4.0.0, =2.0.0, =2.3, =2.3, =clienthcnovehicle and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: OSV:GHSA-3MCP-9WR4-CJQF...

com.bazaarvoice.curator:dropwizard (>=2.1.0 <=2.1.3), com.bazaarvoice.ostrich.examples.calculator:calculator-client (>=2.1.0 <=2.1.1) +147 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=1.3.0-rc1 <=1.3.18)

io.dropwizard:dropwizard-validation MAVEN version =1.3.0-rc1, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =1.3.17-1, =1.6.0-311, =1.6.0-311, =1.0.0-212, =3.1.2-489, =3.1.0-578, =3.3.0-2 - com.github.mtakaki:dropwizard-hikaricp =1.3.1 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory:...

GHSA-3MCP-9WR4-CJQF Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...

PT-2020-6653 · Unknown · Dropwizard-Validation

Name of the Vulnerable Software and Affected Versions: Dropwizard-Validation versions prior to 1.3.19 Dropwizard-Validation versions prior to 2.0.2 Description: The issue allows arbitrary code execution on the host system with the privileges of the Dropwizard service account by injecting arbitrar...

Uber: Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information

The dropwizard instance running on display.uber-adsystem.com is unsecured, meaning any unauthenticated user can view and use it's admin tools. These tools expose sensitive information on Uber production servers, including the current threads running, info on the CPU, and more server info that...

com.datasift.dropwizard:dropwizard-extra-scala (>=0.6.0-2 <=0.6.2-6), com.github.kongchen:swagger-maven-plugin (=1.0) +34 more potentially affected by unknown CVE via com.fasterxml.jackson.module:jackson-module-scala (>=2.0.0 <=2.1.2)

com.fasterxml.jackson.module:jackson-module-scala MAVEN version =2.0.0, =0.6.0-2, =1.1, =0.2.4, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.2.2 - com.wordnik:swagger-jersey-jaxrs2.10.0 =1.2.2 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONMODULE-174825...

Unsafe Dependency Resolution

Overview io.dropwizard:dropwizard-example is a simple library for building production-ready RESTful web services. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure...