CVE-2020-11002 Remote Code Execution (RCE) vulnerability in dropwizard-validation

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

CVE-2020-11002: Improper Neutralization of Special Elements in Output Used by a Downstream Component

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

Server-Side Template Injection

dropwizard-validation is vulnerable to server-side template injection. The vulnerability exists as ViolationCollector does not sanitize Java Expression Language EL expressions and accepts malicious Java EL expressions to be passed into the server-side template in the self-validating feature,...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

Security feature bypass

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

com.github.mtakaki:dropwizard-admin-resource (2.0.0), com.github.mtakaki:dropwizard-circuitbreaker (2.0.0) +63 more potentially affected by CVE-2020-5245 via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.1)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =1.4.613, =1.4.613, =1.4.613, =1.4.613, =1.7.772 and more Source cves: CVE-2020-5245 Source advisory: MEND:CVE-2020-5245...

CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

com.bazaarvoice.curator:dropwizard (>=2.0.0, <=2.1.3), com.bazaarvoice.ostrich.examples.calculator:calculator-client (>=2.0.0, <=2.1.1) +247 more potentially affected by CVE-2020-5245 via io.dropwizard:dropwizard-validation (>=1.3.0-rc1, <=1.3.18)

io.dropwizard:dropwizard-validation MAVEN version =1.3.0-rc1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.33, =1.0.33, =3.1.0, =4.0.0, =2.0.0, =3.1.0 - com.datasift.dropwizard.scala:dropwizard-scala-core2.11 1.3.7-1 and more Source cves: CVE-2020-5245 Source advisory: MEND:CVE-2020-5245...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...

GHSA-3MCP-9WR4-CJQF Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...

com.github.mtakaki:dropwizard-admin-resource (2.0.0), com.github.mtakaki:dropwizard-circuitbreaker (2.0.0) +63 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.1)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =1.4.613, =1.4.613, =1.4.613, =1.4.613, =1.7.772 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: OSV:GHSA-3MCP-9WR4-CJQF...

com.github.mtakaki:dropwizard-admin-resource (2.0.0), com.github.mtakaki:dropwizard-circuitbreaker (2.0.0) +63 more potentially affected by CVE-2020-5245 via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.1)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =1.4.613, =1.4.613, =1.4.613, =1.4.613, =1.7.772 and more Source cves: CVE-2020-5245 Source advisory: GHSA-3MCP-9WR4-CJQF...

com.bazaarvoice.curator:dropwizard (>=2.0.0, <=2.1.3), com.bazaarvoice.ostrich.examples.calculator:calculator-client (>=2.0.0, <=2.1.1) +247 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=1.3.0-rc1, <=1.3.18)

io.dropwizard:dropwizard-validation MAVEN version =1.3.0-rc1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.33, =1.0.33, =3.1.0, =4.0.0, =2.0.0, =3.1.0 - com.datasift.dropwizard.scala:dropwizard-scala-core2.11 1.3.7-1 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory:...

PT-2020-12484

Name of the Vulnerable Software and Affected Versions dropwizard-validation versions prior to 1.3.21 and 2.0.3 Description A server-side template injection was identified in the self-validating feature of dropwizard-validation, enabling attackers to inject arbitrary Java EL expressions, leading t...

CVE-2020-5245: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

PT-2020-6653 · Unknown · Dropwizard-Validation

Name of the Vulnerable Software and Affected Versions: Dropwizard-Validation versions prior to 1.3.19 Dropwizard-Validation versions prior to 2.0.2 Description: The issue allows arbitrary code execution on the host system with the privileges of the Dropwizard service account by injecting arbitrar...