CVE-2020-5245: dropwizard dropwizard_validation Injection
Vulnerability summary
CVE-2020-5245 is a high (CVSS 9.0) Injection vulnerability in dropwizard dropwizard_validation. EPSS estimates a 3.01% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 24-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.9HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
3.01%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.01% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundDropwizard
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dropwizard2 products
- dropwizard_validation< 1.3.19 | ≥ 2.0.0, < 2.0.2
- dropwizard-validation≥ 1.3.0, < 1.3.19 | ≥ 2.0.0, < 2.0.2
Io.dropwizard1 product
- dropwizard-validation≥ 1.3.0-rc1, < 1.3.19 | ≥ 2.0.0, < 2.0.2
Oracle1 product
- blockchain_platform< 21.1.2
3 vendors · 4 products
References
11 links- github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfX Refsource CONFIRMWEBExploitThird Party Advisory
- github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634X Refsource MISCWEBPatchThird Party Advisory
- docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/X Refsource MISCWEBThird Party Advisory
