CVE-2019-10219
Cross-site scripting in Hibernate Validator
CVSS Skor
6.5
EPSS İhtimal
%2.2
Risk Skoru
0.1
Yayın
7 yıl önce
Resmî yama doğrulandı
Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.
Envanterimdeki Etkisi
Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.
Oturum kontrol ediliyor…
Zafiyet Açıklaması
DayBreach CVE AI Araştırması
CVE-2019-10219 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
IMPACT — Etkilenen Ürünler ve Yazılımlar
Affected Products
The following products are affected by CVE-2019-10219 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | Hibernate | hibernate-validator | İncele |
| 2 | redhat | hibernate validator | İncele |
| 3 | redhat | hibernate validator | İncele |
| 4 | redhat | fuse | İncele |
| 5 | redhat | jboss data grid | İncele |
| 6 | redhat | jboss enterprise application platform | İncele |
| 7 | redhat | openshift application runtimes | İncele |
| 8 | redhat | single sign-on | İncele |
| 9 | redhat | jboss enterprise application platform | İncele |
| 10 | redhat | jboss enterprise application platform | İncele |
| 11 | redhat | enterprise linux | İncele |
| 12 | netapp | active iq unified manager | İncele |
| 13 | netapp | management services for element software and netapp hci | İncele |
| 14 | netapp | snapcenter plug-in | İncele |
| 15 | netapp | element | İncele |
| 16 | oracle | access manager | İncele |
| 17 | oracle | access manager | İncele |
| 18 | oracle | access manager | İncele |
| 19 | oracle | agile engineering data management | İncele |
| 20 | oracle | agile product lifecycle analytics | İncele |
| 21 | oracle | agile product lifecycle management | İncele |
| 22 | oracle | agile product lifecycle management | İncele |
| 23 | oracle | agile product lifecycle management integration pack | İncele |
| 24 | oracle | airlines data model | İncele |
| 25 | oracle | airlines data model | İncele |
| 26 | oracle | application express | İncele |
| 27 | oracle | application performance management | İncele |
| 28 | oracle | application performance management | İncele |
| 29 | oracle | application testing suite | İncele |
| 30 | oracle | argus analytics | İncele |
| 31 | oracle | argus analytics | İncele |
| 32 | oracle | argus analytics | İncele |
| 33 | oracle | argus analytics | İncele |
| 34 | oracle | argus insight | İncele |
| 35 | oracle | argus insight | İncele |
| 36 | oracle | argus insight | İncele |
| 37 | oracle | argus safety | İncele |
| 38 | oracle | argus safety | İncele |
| 39 | oracle | argus safety | İncele |
| 40 | oracle | banking apis | İncele |
| 41 | oracle | banking apis | İncele |
| 42 | oracle | banking apis | İncele |
| 43 | oracle | banking apis | İncele |
| 44 | oracle | banking apis | İncele |
| 45 | oracle | banking apis | İncele |
| 46 | oracle | banking apis | İncele |
| 47 | oracle | banking deposits and lines of credit servicing | İncele |
| 48 | oracle | banking digital experience | İncele |
| 49 | oracle | banking digital experience | İncele |
| 50 | oracle | banking digital experience | İncele |
| 51 | oracle | banking digital experience | İncele |
| 52 | oracle | banking digital experience | İncele |
| 53 | oracle | banking digital experience | İncele |
| 54 | oracle | banking digital experience | İncele |
| 55 | oracle | banking enterprise default management | İncele |
| 56 | oracle | banking enterprise default management | İncele |
| 57 | oracle | banking enterprise default management | İncele |
| 58 | oracle | banking enterprise default management | İncele |
| 59 | oracle | banking enterprise default management | İncele |
| 60 | oracle | banking enterprise default managment | İncele |
| 61 | oracle | banking loans servicing | İncele |
| 62 | oracle | banking party management | İncele |
| 63 | oracle | banking platform | İncele |
| 64 | oracle | banking platform | İncele |
| 65 | oracle | banking platform | İncele |
| 66 | oracle | banking platform | İncele |
| 67 | oracle | bi publisher | İncele |
| 68 | oracle | bi publisher | İncele |
| 69 | oracle | bi publisher | İncele |
| 70 | oracle | bi publisher | İncele |
| 71 | oracle | big data spatial and graph | İncele |
| 72 | oracle | business activity monitoring | İncele |
| 73 | oracle | business intelligence | İncele |
| 74 | oracle | business intelligence | İncele |
| 75 | oracle | business intelligence | İncele |
| 76 | oracle | business intelligence | İncele |
| 77 | oracle | business process management suite | İncele |
| 78 | oracle | business process management suite | İncele |
| 79 | oracle | clinical | İncele |
| 80 | oracle | clinical | İncele |
| 81 | oracle | commerce guided search | İncele |
| 82 | oracle | commerce platform | İncele |
| 83 | oracle | communications application session controller | İncele |
| 84 | oracle | communications billing and revenue management | İncele |
| 85 | oracle | communications billing and revenue management | İncele |
| 86 | oracle | communications billing and revenue management elastic charging engine | İncele |
| 87 | oracle | communications billing and revenue management elastic charging engine | İncele |
| 88 | oracle | communications calendar server | İncele |
| 89 | oracle | communications calendar server | İncele |
| 90 | oracle | communications cloud native core automated test suite | İncele |
| 91 | oracle | communications cloud native core binding support function | İncele |
| 92 | oracle | communications cloud native core binding support function | İncele |
| 93 | oracle | communications cloud native core console | İncele |
| 94 | oracle | communications cloud native core network function cloud native environment | İncele |
| 95 | oracle | communications cloud native core network repository function | İncele |
| 96 | oracle | communications cloud native core policy | İncele |
| 97 | oracle | communications cloud native core security edge protection proxy | İncele |
| 98 | oracle | communications cloud native core security edge protection proxy | İncele |
| 99 | oracle | communications cloud native core security edge protection proxy | İncele |
| 100 | oracle | communications cloud native core service communication proxy | İncele |
| 101 | oracle | communications cloud native core unified data repository | İncele |
| 102 | oracle | communications contacts server | İncele |
| 103 | oracle | communications converged application server - service controller | İncele |
| 104 | oracle | communications convergence | İncele |
| 105 | oracle | communications convergent charging controller | İncele |
| 106 | oracle | communications convergent charging controller | İncele |
| 107 | oracle | communications data model | İncele |
| 108 | oracle | communications data model | İncele |
| 109 | oracle | communications data model | İncele |
| 110 | oracle | communications data model | İncele |
| 111 | oracle | communications data model | İncele |
| 112 | oracle | communications design studio | İncele |
| 113 | oracle | communications design studio | İncele |
| 114 | oracle | communications design studio | İncele |
| 115 | oracle | communications design studio | İncele |
| 116 | oracle | communications design studio | İncele |
| 117 | oracle | communications diameter signaling route | İncele |
| 118 | oracle | communications eagle application processor | İncele |
| 119 | oracle | communications instant messaging server | İncele |
| 120 | oracle | communications interactive session recorder | İncele |
| 121 | oracle | communications interactive session recorder | İncele |
| 122 | oracle | communications messaging server | İncele |
| 123 | oracle | communications metasolv solution | İncele |
| 124 | oracle | communications network charging and control | İncele |
| 125 | oracle | communications network charging and control | İncele |
| 126 | oracle | communications network integrity | İncele |
| 127 | oracle | communications network integrity | İncele |
| 128 | oracle | communications offline mediation controller | İncele |
| 129 | oracle | communications operations monitor | İncele |
| 130 | oracle | communications operations monitor | İncele |
| 131 | oracle | communications operations monitor | İncele |
| 132 | oracle | communications operations monitor | İncele |
| 133 | oracle | communications operations monitor | İncele |
| 134 | oracle | communications pricing design center | İncele |
| 135 | oracle | communications pricing design center | İncele |
| 136 | oracle | communications service broker | İncele |
| 137 | oracle | communications services gatekeeper | İncele |
| 138 | oracle | communications session border controller | İncele |
| 139 | oracle | communications session border controller | İncele |
| 140 | oracle | communications session border controller | İncele |
| 141 | oracle | communications session border controller | İncele |
| 142 | oracle | communications unified inventory management | İncele |
| 143 | oracle | communications unified inventory management | İncele |
| 144 | oracle | communications unified inventory management | İncele |
| 145 | oracle | communications unified inventory management | İncele |
| 146 | oracle | communications unified inventory management | İncele |
| 147 | oracle | communications unified inventory management | İncele |
| 148 | oracle | communications unified inventory management | İncele |
| 149 | oracle | communications webrtc session controller | İncele |
| 150 | oracle | communications webrtc session controller | İncele |
| 151 | oracle | data integrator | İncele |
| 152 | oracle | data integrator | İncele |
| 153 | oracle | database server | İncele |
| 154 | oracle | database server | İncele |
| 155 | oracle | database server | İncele |
| 156 | oracle | database server | İncele |
| 157 | oracle | demantra demand management | İncele |
| 158 | oracle | documaker | İncele |
| 159 | oracle | e-business suite | İncele |
| 160 | oracle | enterprise communications broker | İncele |
| 161 | oracle | enterprise data quality | İncele |
| 162 | oracle | enterprise data quality | İncele |
| 163 | oracle | enterprise manager base platform | İncele |
| 164 | oracle | enterprise manager base platform | İncele |
| 165 | oracle | enterprise manager ops center | İncele |
| 166 | oracle | enterprise session border controller | İncele |
| 167 | oracle | enterprise session border controller | İncele |
| 168 | oracle | essbase | İncele |
| 169 | oracle | essbase | İncele |
| 170 | oracle | essbase | İncele |
| 171 | oracle | essbase administration services | İncele |
| 172 | oracle | essbase administration services | İncele |
| 173 | oracle | financial services analytical applications infrastructure | İncele |
| 174 | oracle | financial services analytical applications infrastructure | İncele |
| 175 | oracle | financial services behavior detection platform | İncele |
| 176 | oracle | financial services behavior detection platform | İncele |
| 177 | oracle | financial services behavior detection platform | İncele |
| 178 | oracle | financial services enterprise case management | İncele |
| 179 | oracle | financial services enterprise case management | İncele |
| 180 | oracle | financial services enterprise case management | İncele |
| 181 | oracle | financial services foreign account tax compliance act management | İncele |
| 182 | oracle | financial services foreign account tax compliance act management | İncele |
| 183 | oracle | financial services foreign account tax compliance act management | İncele |
| 184 | oracle | financial services model management and governance | İncele |
| 185 | oracle | financial services trade-based anti money laundering | İncele |
| 186 | oracle | financial services trade-based anti money laundering | İncele |
| 187 | oracle | flexcube investor servicing | İncele |
| 188 | oracle | flexcube investor servicing | İncele |
| 189 | oracle | flexcube investor servicing | İncele |
| 190 | oracle | flexcube investor servicing | İncele |
| 191 | oracle | flexcube investor servicing | İncele |
| 192 | oracle | flexcube investor servicing | İncele |
| 193 | oracle | flexcube private banking | İncele |
| 194 | oracle | flexcube private banking | İncele |
| 195 | oracle | fusion middleware | İncele |
| 196 | oracle | fusion middleware | İncele |
| 197 | oracle | fusion middleware mapviewer | İncele |
| 198 | oracle | goldengate | İncele |
| 199 | oracle | goldengate | İncele |
| 200 | oracle | goldengate | İncele |
RED HAT CSAF/VEX — Ürün Etki Kontrolü
Red Hat bu CVE için henüz bir CSAF/VEX etki kaydı yayımlamamış. Bu durum “etkilenmiyor” anlamına gelmez.
SCORING — CVSS Çoklu Kaynak Skoru
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 6.5 | CVSS V30 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD |
| 6.5 | CVSS V3_0 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CVE CNA |
| 6.1 | CVSS V31 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD |
| 4.3 | CVSS V2 | — | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD |
Yama ve İyileştirme Rehberi (Solution)
Solution & Remediation Advisory
4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.
Etkilenen ürün ve sürümü yukarıdaki kaynak kanıtlarıyla doğrulayın.
İnternete açık servislerde erişimi kısıtlayın ve ağ segmentasyonu uygulayın.
Kanıtta belirtilen resmî güncellemeyi yalnızca eşleşen ürün ve sürüme uygulayın.
Sunucu günlüklerini ve ağ uçlarını anormal çalıştırma belirtileri için izleyin.
Public exploit ve aktif sömürü durumu
Doğrulanmış exploit istihbaratı
Bu CVE için henüz doğrulanmış public PoC, exploit repository’si veya Metasploit modülü bulunamadı.
Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-10219 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2019-10219 weaknesses.
Saldırı Vektörü ve Erişilebilirlik Karakteristiği
ErişimAğ üzerinden
YetkiGerekmiyor
KullanıcıGerekmiyor
Resmi Kaynaklar ve Danışma Bültenleri
[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219vendor-advisory[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219vendor-advisory[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219vendor-advisoryRHSA-2020:0164vendor-advisoryRHSA-2020:0159vendor-advisoryRHSA-2020:0160vendor-advisoryRHSA-2020:0161vendor-advisoryRHSA-2020:0445vendor-advisory[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219vendor-advisory[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219vendor-advisory
CVSS Vektör Radar Grafiği
6.5 / 10Vulnerability Scoring Details
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NNetwork (Ağ)
Low (Düşük)
None (Gerekmiyor)
None (Gerekmiyor)
Low (Düşük)
None (Yok)
None (Yok)
Yama doğrulandı
Zafiyet Türü (CWE & CAPEC)
İlgili Benzer Açıklar
10.0
CVE-2021-44228 Aktif sömürülüyorImproper input validation in Apache Log4j
Yama doğrulandı Public Exploits:22EPSS %100
9.8
CVE-2025-61882 Aktif sömürülüyorImproper authentication in Oracle Corporation Oracle Concurrent Processing
Geçici çözüm Public Exploits:10EPSS %100
9.8
CVE-2020-1938 Aktif sömürülüyorVulnerability in Apache Tomcat
Yama doğrulandı Public Exploits:12EPSS %99
9.8
CVE-2012-4681 Aktif sömürülüyorVulnerability in N/a
Geçici çözüm Public Exploits:3EPSS %99
9.8
CVE-2012-0507 Aktif sömürülüyorVulnerability in N/a
Kısmi yama Public Exploits:1EPSS %98
9.8
CVE-2018-1273 Aktif sömürülüyorCode injection in Spring By Pivotal Spring Framework
Yama doğrulandı Public Exploits:8EPSS %97
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2019-10219"