CVE-2017-7536 (High) detected in hibernate-validator-5.2.4.Final.jar

Vulnerable Library - hibernate-validator-5.2.4.Final.jar

Hibernate's Bean Validation (JSR-303) reference implementation.

Library home page: http://hibernate.org/validator

Path to dependency file: /samples/client/petstore/java/retrofit2-play25/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.hibernate/hibernate-validator/5.2.4.Final/fb18766b576aa6632bcfe9a20a023cbd52bf9769/hibernate-validator-5.2.4.Final.jar

Dependency Hierarchy:

• play-java-ws_2.11-2.5.14.jar (Root Library)
  • play-java_2.11-2.5.14.jar
    • ❌ hibernate-validator-5.2.4.Final.jar (Vulnerable Library)

Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed

Found in base branches: 3.0.0, master

Vulnerability Details

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Publish Date: 2018-01-10

URL: CVE-2017-7536

CVSS 3 Score Details (7.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7536

Release Date: 2018-01-10

Fix Resolution: org.hibernate:hibernate-validator:5.3.6.Final,5.4.2.Final