Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2017-7536

EPSS 0.13% · P31
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2017-7536

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-592
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat Hibernate Validator 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Hibernate Validator是美国红帽（Red Hat）公司的一套Bean验证框架，它能够验证遵循JavaBean规范编写的Java类，也可使用注解指定一个JavaBean上的约束。 Red Hat Hibernate Validator 5.2.5 finalZ之前的5.2.x 版本、5.3.x版本和5.4.x版本中存在安全漏洞。本地攻击者可借助‘ConstraintViolation#getInvalidValue()’函数利用该漏洞获取提升的权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Red Hat, Inc.hibernate-validator 5.2.x before 5.2.5 final -

II. Public POCs for CVE-2017-7536

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-7536

请登录查看更多情报信息。

Same Patch Batch · Red Hat, Inc. · 2018-01-10 · 3 CVEs total

CVE-2017-12189Red Hat JBoss Enterprise Application Platform 安全漏洞
CVE-2017-7559Red Hat Undertow 安全漏洞

IV. Related Vulnerabilities

Same product: hibernate-validator
Same vendor: Red Hat, Inc.
Same weakness: CWE-592

V. Comments for CVE-2017-7536

No comments yet

Leave a comment