Back to the CVE list
CVE-2019-10219

Cross-site scripting in Hibernate Validator

CVSS score

6.5

EPSS probability

%2.2

Risk score

0.1

Published

7 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2019-10219 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2019-10219 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1Hibernatehibernate-validator View
2redhathibernate validator View
3redhathibernate validator View
4redhatfuse View
5redhatjboss data grid View
6redhatjboss enterprise application platform View
7redhatopenshift application runtimes View
8redhatsingle sign-on View
9redhatjboss enterprise application platform View
10redhatjboss enterprise application platform View
11redhatenterprise linux View
12netappactive iq unified manager View
13netappmanagement services for element software and netapp hci View
14netappsnapcenter plug-in View
15netappelement View
16oracleaccess manager View
17oracleaccess manager View
18oracleaccess manager View
19oracleagile engineering data management View
20oracleagile product lifecycle analytics View
21oracleagile product lifecycle management View
22oracleagile product lifecycle management View
23oracleagile product lifecycle management integration pack View
24oracleairlines data model View
25oracleairlines data model View
26oracleapplication express View
27oracleapplication performance management View
28oracleapplication performance management View
29oracleapplication testing suite View
30oracleargus analytics View
31oracleargus analytics View
32oracleargus analytics View
33oracleargus analytics View
34oracleargus insight View
35oracleargus insight View
36oracleargus insight View
37oracleargus safety View
38oracleargus safety View
39oracleargus safety View
40oraclebanking apis View
41oraclebanking apis View
42oraclebanking apis View
43oraclebanking apis View
44oraclebanking apis View
45oraclebanking apis View
46oraclebanking apis View
47oraclebanking deposits and lines of credit servicing View
48oraclebanking digital experience View
49oraclebanking digital experience View
50oraclebanking digital experience View
51oraclebanking digital experience View
52oraclebanking digital experience View
53oraclebanking digital experience View
54oraclebanking digital experience View
55oraclebanking enterprise default management View
56oraclebanking enterprise default management View
57oraclebanking enterprise default management View
58oraclebanking enterprise default management View
59oraclebanking enterprise default management View
60oraclebanking enterprise default managment View
61oraclebanking loans servicing View
62oraclebanking party management View
63oraclebanking platform View
64oraclebanking platform View
65oraclebanking platform View
66oraclebanking platform View
67oraclebi publisher View
68oraclebi publisher View
69oraclebi publisher View
70oraclebi publisher View
71oraclebig data spatial and graph View
72oraclebusiness activity monitoring View
73oraclebusiness intelligence View
74oraclebusiness intelligence View
75oraclebusiness intelligence View
76oraclebusiness intelligence View
77oraclebusiness process management suite View
78oraclebusiness process management suite View
79oracleclinical View
80oracleclinical View
81oraclecommerce guided search View
82oraclecommerce platform View
83oraclecommunications application session controller View
84oraclecommunications billing and revenue management View
85oraclecommunications billing and revenue management View
86oraclecommunications billing and revenue management elastic charging engine View
87oraclecommunications billing and revenue management elastic charging engine View
88oraclecommunications calendar server View
89oraclecommunications calendar server View
90oraclecommunications cloud native core automated test suite View
91oraclecommunications cloud native core binding support function View
92oraclecommunications cloud native core binding support function View
93oraclecommunications cloud native core console View
94oraclecommunications cloud native core network function cloud native environment View
95oraclecommunications cloud native core network repository function View
96oraclecommunications cloud native core policy View
97oraclecommunications cloud native core security edge protection proxy View
98oraclecommunications cloud native core security edge protection proxy View
99oraclecommunications cloud native core security edge protection proxy View
100oraclecommunications cloud native core service communication proxy View
101oraclecommunications cloud native core unified data repository View
102oraclecommunications contacts server View
103oraclecommunications converged application server - service controller View
104oraclecommunications convergence View
105oraclecommunications convergent charging controller View
106oraclecommunications convergent charging controller View
107oraclecommunications data model View
108oraclecommunications data model View
109oraclecommunications data model View
110oraclecommunications data model View
111oraclecommunications data model View
112oraclecommunications design studio View
113oraclecommunications design studio View
114oraclecommunications design studio View
115oraclecommunications design studio View
116oraclecommunications design studio View
117oraclecommunications diameter signaling route View
118oraclecommunications eagle application processor View
119oraclecommunications instant messaging server View
120oraclecommunications interactive session recorder View
121oraclecommunications interactive session recorder View
122oraclecommunications messaging server View
123oraclecommunications metasolv solution View
124oraclecommunications network charging and control View
125oraclecommunications network charging and control View
126oraclecommunications network integrity View
127oraclecommunications network integrity View
128oraclecommunications offline mediation controller View
129oraclecommunications operations monitor View
130oraclecommunications operations monitor View
131oraclecommunications operations monitor View
132oraclecommunications operations monitor View
133oraclecommunications operations monitor View
134oraclecommunications pricing design center View
135oraclecommunications pricing design center View
136oraclecommunications service broker View
137oraclecommunications services gatekeeper View
138oraclecommunications session border controller View
139oraclecommunications session border controller View
140oraclecommunications session border controller View
141oraclecommunications session border controller View
142oraclecommunications unified inventory management View
143oraclecommunications unified inventory management View
144oraclecommunications unified inventory management View
145oraclecommunications unified inventory management View
146oraclecommunications unified inventory management View
147oraclecommunications unified inventory management View
148oraclecommunications unified inventory management View
149oraclecommunications webrtc session controller View
150oraclecommunications webrtc session controller View
151oracledata integrator View
152oracledata integrator View
153oracledatabase server View
154oracledatabase server View
155oracledatabase server View
156oracledatabase server View
157oracledemantra demand management View
158oracledocumaker View
159oraclee-business suite View
160oracleenterprise communications broker View
161oracleenterprise data quality View
162oracleenterprise data quality View
163oracleenterprise manager base platform View
164oracleenterprise manager base platform View
165oracleenterprise manager ops center View
166oracleenterprise session border controller View
167oracleenterprise session border controller View
168oracleessbase View
169oracleessbase View
170oracleessbase View
171oracleessbase administration services View
172oracleessbase administration services View
173oraclefinancial services analytical applications infrastructure View
174oraclefinancial services analytical applications infrastructure View
175oraclefinancial services behavior detection platform View
176oraclefinancial services behavior detection platform View
177oraclefinancial services behavior detection platform View
178oraclefinancial services enterprise case management View
179oraclefinancial services enterprise case management View
180oraclefinancial services enterprise case management View
181oraclefinancial services foreign account tax compliance act management View
182oraclefinancial services foreign account tax compliance act management View
183oraclefinancial services foreign account tax compliance act management View
184oraclefinancial services model management and governance View
185oraclefinancial services trade-based anti money laundering View
186oraclefinancial services trade-based anti money laundering View
187oracleflexcube investor servicing View
188oracleflexcube investor servicing View
189oracleflexcube investor servicing View
190oracleflexcube investor servicing View
191oracleflexcube investor servicing View
192oracleflexcube investor servicing View
193oracleflexcube private banking View
194oracleflexcube private banking View
195oraclefusion middleware View
196oraclefusion middleware View
197oraclefusion middleware mapviewer View
198oraclegoldengate View
199oraclegoldengate View
200oraclegoldengate View
Total affected vendors: 4|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
6.5CVSS V30MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NNVD
6.5CVSS V3_0MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE CNA
6.1CVSS V31MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD
4.3CVSS V2—AV:N/AC:M/Au:N/C:N/I:P/A:NNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

cvelist

Upstream fix commit

Open source
cvelist

Upstream fix commit

Open source
reference

Upstream fix commit

Open source
reference

Upstream fix commit

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-10219 is associated with the following CWEs:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2019-10219 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219vendor-advisory[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219vendor-advisory[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219vendor-advisoryRHSA-2020:0164vendor-advisoryRHSA-2020:0159vendor-advisoryRHSA-2020:0160vendor-advisoryRHSA-2020:0161vendor-advisoryRHSA-2020:0445vendor-advisory[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219vendor-advisory[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219vendor-advisory

CVSS Vector Radar Chart

6.5 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityNone

Vulnerability Scoring Details

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)None

Yama doğrulandı

4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

H
Hibernate logo
Hibernate
R
redhat logo
redhat
N
netapp logo
netapp
O
oracle logo
oracle

Weakness Type (CWE & CAPEC)

CWE-79

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2019-10219"