Description
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
Metrics
CVSS 3.1 6.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | A-MQ Clients 2 | — |
| Red Hat | Cryostat 2 | — |
| Red Hat | Red Hat AMQ Broker 7 | — |
| Red Hat | Red Hat A-MQ Online | — |
| Red Hat | Red Hat BPM Suite 6 | — |
| Red Hat | Red Hat CodeReady Studio 12 | — |
| Red Hat | Red Hat Data Grid 8 | — |
| Red Hat | Red Hat Decision Manager 7 | — |
| Red Hat | Red Hat Fuse 7 | — |
| Red Hat | Red Hat JBoss BRMS 5 | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — |
| Red Hat | Red Hat JBoss Data Virtualization 6 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 5 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Continuous Delivery | — |
| Red Hat | Red Hat JBoss Fuse 6 | — |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — |
| Red Hat | Red Hat JBoss Operations Network 3 | — |
| Red Hat | Red Hat JBoss SOA Platform 5 | — |
| Red Hat | Red Hat OpenStack Platform 10 (Newton) | — |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — |
| Red Hat | Red Hat Process Automation 7 | — |
| Red Hat | Red Hat Satellite 6 | — |
| Red Hat | Red Hat Single Sign-On 7 | — |
| Red Hat | Red Hat support for Spring Boot | — |
| Red Hat | streams for Apache Kafka | — |
References
- https://access.redhat.com/security/cve/CVE-2023-1932Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1809444Issue Tracking, Vendor Advisory
Timeline
- Published
- Nov 7, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed