CVE-2020-10693

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-106957.8An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can CVE-2020-106968.8A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a maliciousCVE-2020-106974.4A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage CVE-2020-106983.3A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run frCVE-2020-106997.8A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enCVE-2020-10707.8An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file systemCVE-2020-107005.3A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A mCVE-2020-107016.5A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-onCVE-2020-107025.5A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in CVE-2020-107036.5A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fCVE-2020-107047.5A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active DirecCVE-2020-107057.5A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may ca