CVE-2023-1932
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Analyzed - secalert@redhat.com
- Published
- 2024-11-07
- Last modified
- 2024-11-07
- Weaknesses
- CWE-79
Affected products
- Hibernate-validator (Hibernate)
- A Mq Clients (Redhat)
- Amq Broker (Redhat)
- Amq Online (Redhat)
- Amq Streams (Redhat)
- Codeready Studio (Redhat)
- Cryostat (Redhat)
- Jboss Data Grid (Redhat)
- Jboss Data Virtualization (Redhat)
- Jboss Developer Studio (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Application Platform Cd (Redhat)
- Jboss Enterprise Bpms Platform (Redhat)
- Jboss Enterprise Brms Platform (Redhat)
- Jboss Enterprise Soa Platform (Redhat)
- Jboss Fuse (Redhat)
- Jboss Fuse Service Works (Redhat)
- Jboss Operations Network (Redhat)
- Openshift Application Runtimes (Redhat)
- Openstack (Redhat)
- Openstack Platform (Redhat)
- Red Hat Single Sign On (Redhat)
- Satellite (Redhat)
- Single Sign-on (Redhat)
References
- https://access.redhat.com/security/cve/CVE-2023-1932
- https://bugzilla.redhat.com/show_bug.cgi?id=1809444
