io.dropwizard.archetypes:java-simple (0.9.0-rc5), io.dropwizard.modules:dropwizard-elasticsearch (0.9.0-rc5-1) +26 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc5)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.0-rc5 -...

com.bazaarvoice.dropwizard:dropwizard-configurable-assets-bundle (0.2.0-rc1), com.github.abduegal:microservice-framework (>=0.8, <=0.8.1) +24 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.0-rc2)

io.dropwizard:dropwizard-validation MAVEN version 0.7.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - com.bazaarvoice.dropwizard:dropwizard-configurable-assets-bundle 0.2.0-rc1 -...

br.com.ingenieux.dropwizard:dropwizard-envvar (0.0.1), br.com.ingenieux.dropwizard:dropwizard-governator (>=0.7.0.3, <=0.7.0.4) +232 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.7.1)

io.dropwizard:dropwizard-validation MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - br.com.ingenieux.dropwizard:dropwizard-envvar 0.0.1 -...

io.dropwizard:dropwizard-assets (0.8.0-rc1), io.dropwizard:dropwizard-auth (0.8.0-rc1) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.0-rc1)

io.dropwizard:dropwizard-validation MAVEN version 0.8.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard:dropwizard-assets 0.8.0-rc1 - io.dropwizard:dropwizard-auth 0.8.0-rc1 -...

io.dropwizard.archetypes:java-simple (0.9.0-rc3), io.dropwizard:dropwizard-assets (0.9.0-rc3) +24 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc3)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.0-rc3 - io.dropwizard:dropwizard-assets...

fr.mmarie:gitlab-jira-integration-api (>=0.2.0, <=0.5.0-rc1), fr.mmarie:gitlab-jira-integration-application (0.2.0) +23 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.0-rc4)

io.dropwizard:dropwizard-validation MAVEN version 0.9.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - fr.mmarie:gitlab-jira-integration-api =0.2.0, =0.5.0-rc1 -...

io.dropwizard.archetypes:java-simple (0.9.1-rc1), io.dropwizard:dropwizard-assets (0.9.1-rc1) +20 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.9.1-rc1)

io.dropwizard:dropwizard-validation MAVEN version 0.9.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - io.dropwizard.archetypes:java-simple 0.9.1-rc1 - io.dropwizard:dropwizard-assets...

co.paralleluniverse:comsat-dropwizard (0.5.0), com.hubspot.dropwizard:dropwizard-guice (0.8.3.0) +26 more potentially affected by CVE-2020-11002 via io.dropwizard:dropwizard-validation (0.8.3)

io.dropwizard:dropwizard-validation MAVEN version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.dropwizard:dropwizard-validation and may be impacted: - co.paralleluniverse:comsat-dropwizard 0.5.0 - com.hubspot.dropwizard:dropwizard-guice...

CVE-2020-11002 Remote Code Execution (RCE) vulnerability in dropwizard-validation

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

CVE-2020-11002

CVE-2020-11002 affects Dropwizard-validation prior to 1.3.21 and 2.0.3, where a server-side template injection in the self-validating feature enables injection of arbitrary Java EL expressions, leading to Remote Code Execution (RCE). Affected: dropwizard-validation versions before 1.3.21 and 2.0....

CVE-2020-11002

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

com.bendb.dropwizard:dropwizard-jooq (2.0.2-0), com.bendb.dropwizard:dropwizard-redis (2.0.2-0) +79 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.2)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =0.99.0, =0.311.6, =0.311.6, =0.312.2-rc2, =0.711.0 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: MEND:CVE-2020-11002...

at.yawk.dropwizard-nagios:dropwizard-nagios (1.0), be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-1, <=0.1-16) +741 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=0.7.0-rc1, <=1.3.20)

io.dropwizard:dropwizard-validation MAVEN version =0.7.0-rc1, =0.1-1, =0.1-1, =0.1-9, =0.1-5, =0.8-1-1, =0.0.105, =0.7.0.3, =1.0, =0.1.0, =0.2.0, =0.7.0 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: MEND:CVE-2020-11002...

CVE-2020-11002: Improper Neutralization of Special Elements in Output Used by a Downstream Component

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you a...

com.yahoo.elide:dropwizard-elide (2.3.6), com.yahoo.elide:elide-datastore-hibernate (2.3.6) +4 more potentially affected by CVE-2020-5289 via com.yahoo.elide:elide-core (2.3.6)

com.yahoo.elide:elide-core MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.yahoo.elide:elide-core and may be impacted: - com.yahoo.elide:dropwizard-elide 2.3.6 - com.yahoo.elide:elide-datastore-hibernate 2.3.6 -...

com.yahoo.elide:dropwizard-elide (2.3.14), com.yahoo.elide:elide-datastore-hibernate (2.3.14) +4 more potentially affected by CVE-2020-5289 via com.yahoo.elide:elide-core (2.3.14)

com.yahoo.elide:elide-core MAVEN version 2.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on com.yahoo.elide:elide-core and may be impacted: - com.yahoo.elide:dropwizard-elide 2.3.14 - com.yahoo.elide:elide-datastore-hibernate 2.3.14 -...

com.yahoo.elide:dropwizard-elide (3.0.12), com.yahoo.elide:elide-datastore-hibernate (3.0.12) +6 more potentially affected by CVE-2020-5289 via com.yahoo.elide:elide-core (3.0.12)

com.yahoo.elide:elide-core MAVEN version 3.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.yahoo.elide:elide-core and may be impacted: - com.yahoo.elide:dropwizard-elide 3.0.12 - com.yahoo.elide:elide-datastore-hibernate 3.0.12 -...

Server-Side Template Injection

dropwizard-validation is vulnerable to server-side template injection. The vulnerability exists as ViolationCollector does not sanitize Java Expression Language EL expressions and accepts malicious Java EL expressions to be passed into the server-side template in the self-validating feature,...

Dropwizard-Validation Injection Vulnerability

Dropwizard is a Java framework for the development of easy to operate , high-performance RESTful web services . An injection vulnerability exists in Dropwizard-Validation versions prior to 1.3.19 and prior to 2.0.2. The vulnerability arises when a web system or product lacks proper validation of...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...