CVE-2017-7536

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

CVSS v3.0 7.0 HIGH
CVSS v2.0 4.4 MEDIUM

7.0^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1465573	Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3454	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3141	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:2811	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:2810	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:2809	Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:2808	Vendor Advisory
http://www.securitytracker.com/id/1039744	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101048	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2743	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2742	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2741	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2740	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2927	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3817	Vendor Advisory
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:hibernate_validator::::::::
	cpe:2.3:a:redhat:hibernate_validator::::::::
	cpe:2.3:a:redhat:hibernate_validator::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:satellite:6.4:::::::*
	cpe:2.3:a:redhat:satellite_capsule:6.4:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:::::::*

OR	cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration 4 (hide)

AND

OR	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:::::::*

OR	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration 5 (hide)

AND

OR	cpe:2.3:a:redhat:virtualization:4.0:::::::*
	cpe:2.3:a:redhat:virtualization_host:4.0:::::::*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Information

Published : 2018-01-10 07:29

Updated : 2022-03-10 05:57

NVD link : CVE-2017-7536

Mitre link : CVE-2017-7536

JSON object : View

CWE

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Products Affected

redhat

satellite_capsule
enterprise_linux
jboss_enterprise_application_platform
virtualization
satellite
virtualization_host
hibernate_validator

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1465573", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1465573", "tags": ["Issue Tracking", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2017:3458", "name": "RHSA-2017:3458", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:3456", "name": "RHSA-2017:3456", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:3455", "name": "RHSA-2017:3455", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:3454", "name": "RHSA-2017:3454", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:3141", "name": "RHSA-2017:3141", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2811", "name": "RHSA-2017:2811", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2810", "name": "RHSA-2017:2810", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2809", "name": "RHSA-2017:2809", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:2808", "name": "RHSA-2017:2808", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securitytracker.com/id/1039744", "name": "1039744", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/101048", "name": "101048", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2743", "name": "RHSA-2018:2743", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2742", "name": "RHSA-2018:2742", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2741", "name": "RHSA-2018:2741", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2740", "name": "RHSA-2018:2740", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2927", "name": "RHSA-2018:2927", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:3817", "name": "RHSA-2018:3817", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E", "name": "[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities", "tags": ["Issue Tracking", "Third Party Advisory"], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue()."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-470"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-7536", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}}, "publishedDate": "2018-01-10T15:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.2.5", "versionStartIncluding": "5.2.0"}, {"cpe23Uri": "cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.3.6", "versionStartIncluding": "5.3.0"}, {"cpe23Uri": "cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.4.2", "versionStartIncluding": "5.4.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-03-10T13:57Z"}

7.0 /10