CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-11002

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

Dropwizard-Validation Code Execution

The vulnerability of the Dropwizard-Validation software exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with privileges of the Dropwizard service account...

Server-Side Template Injection

dropwizard-validation is vulnerable to Server-Side Template Injection. The vulnerability exists as ViolationCollector does not sanitize Java Expression Language EL expressions and accepts malicious Java EL expressions to be passed into the server-side template in the self-validating feature,...

dropwizard-validation injection vulnerability (CNVD-2020-22964)

dropwizard-validation is a library that supports building RESTful web services that can be used in production environments. An injection vulnerability exists in dropwizard-validation versions prior to 2.0.3 and prior to 1.3.21. An attacker can exploit this vulnerability to inject arbitrary Java E...

CVE-2020-11002

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

GHSA-8JPX-M2WH-2V34 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...

com.massrelevance:dropwizard-scala_2.10 (0.7.0-rc1), io.dropwizard:dropwizard-assets (0.7.0-rc1) +19 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc1)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.massrelevance:dropwizard-scala2.10 0.7.0-rc1 - io.dropwizard:dropwizard-assets...

com.bazaarvoice.dropwizard:dropwizard-configurable-assets-bundle (0.2.0-rc1), com.github.abduegal:microservice-framework (>=0.8, <=0.8.1) +24 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.bazaarvoice.dropwizard:dropwizard-configurable-assets-bundle 0.2.0-rc1 -...

io.dropwizard:dropwizard-assets (0.7.0-rc3), io.dropwizard:dropwizard-auth (0.7.0-rc3) +18 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard:dropwizard-assets 0.7.0-rc3 - io.dropwizard:dropwizard-auth 0.7.0-rc3 -...

br.com.ingenieux.dropwizard:dropwizard-envvar (0.0.1), br.com.ingenieux.dropwizard:dropwizard-governator (>=0.7.0.3, <=0.7.0.4) +232 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.1)

io.dropwizard:dropwizard-validation MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - br.com.ingenieux.dropwizard:dropwizard-envvar 0.0.1 -...

io.dropwizard:dropwizard-assets (0.8.0-rc1), io.dropwizard:dropwizard-auth (0.8.0-rc1) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc1)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard:dropwizard-assets 0.8.0-rc1 - io.dropwizard:dropwizard-auth 0.8.0-rc1 -...

io.dropwizard.archetypes:java-simple (0.8.0-rc2), io.dropwizard:dropwizard-assets (0.8.0-rc2) +30 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc2 - io.dropwizard:dropwizard-assets...

com.hubspot.dropwizard:dropwizard-guice (0.8.0), io.dropwizard.archetypes:java-simple (0.8.0-rc3) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.hubspot.dropwizard:dropwizard-guice 0.8.0 - io.dropwizard.archetypes:java-simple...

io.dropwizard.archetypes:java-simple (0.8.0-rc4), io.dropwizard:dropwizard-assets (0.8.0-rc4) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc4)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc4 - io.dropwizard:dropwizard-assets...

io.dropwizard.archetypes:java-simple (0.8.0-rc5), io.dropwizard:dropwizard-assets (0.8.0-rc5) +21 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc5)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.0-rc5 - io.dropwizard:dropwizard-assets...

be.fluid-it.tools.dropwizard:wizard-in-a-box (>=0.8-1-1, <=0.8-1-2), com.bazaarvoice.curator:dropwizard (1.4.2) +81 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.tools.dropwizard:wizard-in-a-box =0.8-1-1, =0.7.0, =0.7.0, =0.7.0, =0.7.2 -...

io.dropwizard.archetypes:java-simple (0.8.1-rc2), io.dropwizard:dropwizard-assets (0.8.1-rc2) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.1-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.1-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.8.1-rc2 - io.dropwizard:dropwizard-assets...

be.fluid-it.tools.dropwizard:wizard-in-a-box (>=0.8-2-1, <=0.8-2-2), com.disdar:disdar-api-client-java (0.3.0) +38 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.2)

io.dropwizard:dropwizard-validation MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - be.fluid-it.tools.dropwizard:wizard-in-a-box =0.8-2-1, =1.0.0, =0.1.12, =0.5.25 -...