CVE-2019-10219: hibernate hibernate-validator
Vulnerability summary
CVE-2019-10219 is a medium (CVSS 6.5) vulnerability in hibernate hibernate-validator. EPSS estimates a 2.16% chance of exploitation in the next 30 days, higher than 82.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4Timeline
- 08-11-2019PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
2.16%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPocadaptation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle177 products
- access_manager11.1.2.3.0 | 12.2.1.3.0 | 12.2.1.4.0
- agile_engineering_data_management6.2.1.0
- agile_product_lifecycle_analytics3.6.1
- agile_product_lifecycle_management9.3.3 | 9.3.6
- agile_product_lifecycle_management_integration_pack3.6
Redhat6 products
- fuse1.0
- hibernate_validator< 6.0.18 | 6.1.0:alpha1 | 6.1.0:alpha2 | 6.1.0:alpha3 | 6.1.0:alpha4 | 6.1.0:alpha5 | 6.1.0:alpha6
- jboss_data_gridna
- jboss_enterprise_application_platformna | 7.2 | 7.3
- openshift_application_runtimesna
Netapp4 products
Debian1 product
- libhibernate-validator-javaAll versions (No fix recorded)
Hibernate1 product
- hibernate-validator≥ 6.0.0.Alpha1, ≤ 6.0.17.Final | ≥ 6.1.0.Alpha1, ≤ 6.1.0.Alpha6
Org.hibernate1 product
- hibernate-validator≥ 6.1.0.Alpha1, < 6.1.0.Alpha6 | ≥ 6.0.0.Alpha1, < 6.0.18.Final
Org.hibernate.validator1 product
- hibernate-validator≥ 6.1.0.Alpha1, < 6.1.0.Alpha6 | ≥ 6.0.0.Alpha1, < 6.0.18.Final
Ubuntu1 product
- libhibernate-validator-javaAll versions (No fix recorded)
8 vendors · 192 products
References
32 linksShow all 32 references
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEB
