Read the docs
TI-2020-08595 Aliases CVE-2020-10693GHSA-rmrm-75hp-phr2

Improper input validation in hibernate-validator

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 16 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Why it matters now

EPSS 0.02351 83rd percentileScored 2026-11-07
Fix Partial org.hibernate.validator:hibernate-validator (Maven): 6.1.5.Final, 6.0.20.Finalorg.hibernate:hibernate-validator (Maven): 6.1.5.Final, 6.0.20.FinalRed Hat: 16 advisoriesRed Hat: 16 fixed, 14 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hibernatehibernate-validator6.1.2.Final—No fix listedCNA
—org.hibernate.validator:hibernate-validator (Maven)6.1.0.Final to before 6.1.5.Final6.1.5.FinalPatch availableGHSA-rmrm-75hp-phr2
—org.hibernate.validator:hibernate-validator (Maven)before 6.0.20.Final6.0.20.FinalPatch availableGHSA-rmrm-75hp-phr2
—org.hibernate:hibernate-validator (Maven)6.1.0.Final to before 6.1.5.Final6.1.5.FinalPatch availableGHSA-rmrm-75hp-phr2
—org.hibernate:hibernate-validator (Maven)before 6.0.20.Final6.0.20.FinalPatch availableGHSA-rmrm-75hp-phr2
  • hibernate-validator VendorHibernate Affected 6.1.2.Final Fixed in — No fix listed CNA
  • org.hibernate.validator:hibernate-validator (Maven) Vendor— Affected 6.1.0.Final to before 6.1.5.Final Fixed in 6.1.5.Final Patch available GHSA-rmrm-75hp-phr2
  • org.hibernate.validator:hibernate-validator (Maven) Vendor— Affected before 6.0.20.Final Fixed in 6.0.20.Final Patch available GHSA-rmrm-75hp-phr2
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected 6.1.0.Final to before 6.1.5.Final Fixed in 6.1.5.Final Patch available GHSA-rmrm-75hp-phr2
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected before 6.0.20.Final Fixed in 6.0.20.Final Patch available GHSA-rmrm-75hp-phr2

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*5.0.0 to before 6.0.20; 6.1.2 to before 6.1.5VulnerableRed Hat
cpe:2.3:a:redhat:hibernate_validator:7.0.0:alpha1:*:*:*:*:*:*7.0.0 alpha1VulnerableRed Hat
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:*17.0.0.3 – 20.0.0.10VulnerableIBM
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:satellite:6.8:*:*:*:*:*:*:*6.8VulnerableRed Hat
cpe:2.3:a:redhat:satellite_capsule:6.8:*:*:*:*:*:*:*6.8VulnerableRed Hat
  • cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:* Versions 5.0.0 to before 6.0.20; 6.1.2 to before 6.1.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hibernate_validator:7.0.0:alpha1:*:*:*:*:*:* Versions 7.0.0 alpha1 Vulnerable ·Red Hat
  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:liberty:*:*:* Versions 17.0.0.3 – 20.0.0.10 Vulnerable ·IBM
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.8:*:*:*:*:*:*:* Versions 6.8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_capsule:6.8:*:*:*:*:*:*:* Versions 6.8 Vulnerable ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.4.2Vulnerablequarkusio
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.4.2 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-rmrm-75hp-phr2 org.hibernate.validator:hibernate-validator (Maven) Fixed in 6.1.5.Final Advisory →
  • Fix · GHSA-rmrm-75hp-phr2 org.hibernate.validator:hibernate-validator (Maven) Fixed in 6.0.20.Final Advisory →
  • Fix · GHSA-rmrm-75hp-phr2 org.hibernate:hibernate-validator (Maven) Fixed in 6.1.5.Final Advisory →
  • Fix · GHSA-rmrm-75hp-phr2 org.hibernate:hibernate-validator (Maven) Fixed in 6.0.20.Final Advisory →

Red Hat 16 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:4961 Released 2020-11-05 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.9.0 security update
    • RHPAM 7.9.0
  • RHSA-2020:4960 Released 2020-11-05 · Red Hat rating Moderate
    Red Hat Decision Manager 7.9.0 security update
    • RHDM 7.9.0
Show 13 more Red Hat advisories
  • RHSA-2020:4366 Released 2020-10-27 · Red Hat rating Important
    Satellite 6.8 release
    • Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
    • Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
  • RHSA-2020:4252 Released 2020-10-14 · Red Hat rating Important
    Red Hat build of Quarkus 1.7.5 release and security update
    • Red Hat build of Quarkus 1.7.5
  • RHSA-2020:3806 Released 2020-09-23 · Red Hat rating Important
    Red Hat support for Spring Boot 2.2.6.SP2 security update
    • Red Hat Runtimes Spring Boot 2.2.6
  • RHSA-2020:3642 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:3638 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el7eap +47
  • RHSA-2020:3639 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el8eap +47
  • RHSA-2020:3637 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el6eap +47
  • RHSA-2020:3539 Released 2020-09-02 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:3501 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update
    • Red Hat Single Sign-On 7.4.2
  • RHSA-2020:3463 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el8eap +47
  • RHSA-2020:3462 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el7eap +47
  • RHSA-2020:3461 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el6eap +47
  • RHSA-2020:3464 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix yet
RHDM 7.9.0Fixed RHSA-2020:4960
RHPAM 7.9.0Fixed RHSA-2020:4961
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:3637
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:3638
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:3639
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:3463
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:3461
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:3462
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:3464
Red Hat Runtimes Spring Boot 2.2.6Fixed RHSA-2020:3806
Red Hat Satellite 6.8Fixed RHSA-2020:4366
Red Hat Satellite Capsule 6.8Fixed RHSA-2020:4366
Red Hat Single Sign-On 7.4.2Fixed RHSA-2020:3501
Red Hat build of Quarkus 1.7.5Fixed RHSA-2020:4252
Text-Only RHOARFixed RHSA-2020:3539
Not affected: 1 product
  • Red Hat Data Grid 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10693
  2. 2026-10-03 Alias added: GHSA-rmrm-75hp-phr2

References

Patch 1

Advisory 2

Other 7

  • TI-2025-24565 hibernate-validator insecure default Expression Language interpolation CVSS 4.0MEDIUM 6.9
  • TI-2020-15656 SQL injection in hibernate-core CVSS 3.1HIGH 7.4
  • TI-2019-11104 SQL injection in Hibernate CVSS 3.1MEDIUM 6.5
  • TI-2019-07539 Cross-site scripting in hibernate-validator CVSS 3.1MEDIUM 6.1
  • TI-2023-01816 Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences