CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

Security feature bypass

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245

Technical specifics for CVE-2020-5245 (affected software, root cause, impact, and fix) are provided in the Initial document; there are no additional concrete details about this CVE in the Connected documents.

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

com.github.mtakaki:dropwizard-admin-resource (2.0.0), com.github.mtakaki:dropwizard-circuitbreaker (2.0.0) +63 more potentially affected by CVE-2020-5245 via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.1)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =1.4.613, =1.4.613, =1.4.613, =1.4.613, =1.7.772 and more Source cves: CVE-2020-5245 Source advisory: MEND:CVE-2020-5245...

com.bazaarvoice.curator:dropwizard (>=2.0.0, <=2.1.3), com.bazaarvoice.ostrich.examples.calculator:calculator-client (>=2.0.0, <=2.1.1) +247 more potentially affected by CVE-2020-5245 via io.dropwizard:dropwizard-validation (>=1.3.0-rc1, <=1.3.18)

io.dropwizard:dropwizard-validation MAVEN version =1.3.0-rc1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.33, =1.0.33, =3.1.0, =4.0.0, =2.0.0, =3.1.0 - com.datasift.dropwizard.scala:dropwizard-scala-core2.11 1.3.7-1 and more Source cves: CVE-2020-5245 Source advisory: MEND:CVE-2020-5245...

CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...

com.github.mtakaki:dropwizard-admin-resource (2.0.0), com.github.mtakaki:dropwizard-circuitbreaker (2.0.0) +63 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.1)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =1.4.613, =1.4.613, =1.4.613, =1.4.613, =1.7.772 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory: OSV:GHSA-3MCP-9WR4-CJQF...

GHSA-3MCP-9WR4-CJQF Remote Code Execution (RCE) vulnerability in dropwizard-validation

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...

com.github.mtakaki:dropwizard-admin-resource (2.0.0), com.github.mtakaki:dropwizard-circuitbreaker (2.0.0) +63 more potentially affected by CVE-2020-5245 via io.dropwizard:dropwizard-validation (>=2.0.0, <=2.0.1)

io.dropwizard:dropwizard-validation MAVEN version =2.0.0, =2.0.0, =1.4.613, =1.4.613, =1.4.613, =1.4.613, =1.7.772 and more Source cves: CVE-2020-5245 Source advisory: GHSA-3MCP-9WR4-CJQF...

com.bazaarvoice.curator:dropwizard (>=2.0.0, <=2.1.3), com.bazaarvoice.ostrich.examples.calculator:calculator-client (>=2.0.0, <=2.1.1) +247 more potentially affected by CVE-2020-11002 +1 more via io.dropwizard:dropwizard-validation (>=1.3.0-rc1, <=1.3.18)

io.dropwizard:dropwizard-validation MAVEN version =1.3.0-rc1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.33, =1.0.33, =3.1.0, =4.0.0, =2.0.0, =3.1.0 - com.datasift.dropwizard.scala:dropwizard-scala-core2.11 1.3.7-1 and more Source cves: CVE-2020-11002, CVE-2020-5245 Source advisory:...

PT-2020-12484

Name of the Vulnerable Software and Affected Versions dropwizard-validation versions prior to 1.3.21 and 2.0.3 Description A server-side template injection was identified in the self-validating feature of dropwizard-validation, enabling attackers to inject arbitrary Java EL expressions, leading t...

PT-2020-6653 · Unknown · Dropwizard-Validation

Name of the Vulnerable Software and Affected Versions: Dropwizard-Validation versions prior to 1.3.19 Dropwizard-Validation versions prior to 2.0.2 Description: The issue allows arbitrary code execution on the host system with the privileges of the Dropwizard service account by injecting arbitrar...

CVE-2020-5245: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in...

com.datasift.dropwizard:dropwizard-extra-hbase (>=0.5.1-1, <=0.5.1-3), org.hornetq.examples.jms:common (>=2.3.0.alpha, <=2.3.0.beta2) +13 more potentially affected by CVE-2019-20444 via io.netty:netty (3.4.5.final)

io.netty:netty MAVEN version 3.4.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.datasift.dropwizard:dropwizard-extra-hbase =0.5.1-1, =2.3.0.alpha, =2.3.0.alpha, =2.3.0.alpha, =2.3.0.alpha, =2.3.0.beta2...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.9.1), org.keycloak:keycloak-adapter-core (2.5.4.final) +54 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (2.5.4.final)

org.keycloak:keycloak-core MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.9.1 - org.keycloak:keycloak-adapter-core 2.5.4.fin...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.2.1, <=0.3.0), org.keycloak:keycloak-account-api (1.5.0-final) +84 more potentially affected by CVE-2019-10201 via org.keycloak:keycloak-core (1.5.0-final)

org.keycloak:keycloak-core MAVEN version 1.5.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.2.1, =0.3.0 - org.keycloak:keycloak-account-api...