CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2020-5245
High (8.8). EPSS 3.1% chance of exploitation in the next 30 days. Fixed in io.dropwizard:dropwizard-validation 1.3.19, 2.0.2.
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Severity
- EPSS
- 3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dropwizard:dropwizard_validation
- oracle:blockchain_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3mcp-9wr4-cjqf | Maven | io.dropwizard:dropwizard-validation | >=1.3.0-rc1 <1.3.19 | 1.3.19 |
| GHSA-3mcp-9wr4-cjqf | Maven | io.dropwizard:dropwizard-validation | >=2.0.0 <2.0.2 | 2.0.2 |
References
- https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions
- https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
- https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
- https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634