DEBIAN-CVE-2017-7536

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2017-7536
Published: 10 Jan 2018, 15:29
Last modified:28 Apr 2026, 20:17

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7 HIGH
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Jan 2018, 15:29
Published
Vulnerability first disclosed
28 Apr 2026, 20:17
Last Modified
Vulnerability information updated

Description

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • debian•libhibernate-validator-java

    < 4.3.3-4 | < 4.3.3-4 | < 4.3.3-4 | < 4.3.3-4

References (1)