CVE-2020-5245CWE-74

Remote Code Execution (RCE) vulnerability in dropwizard-validation

High · published February 24, 2020

CVSS v3.1
7.9
EPSS
3%
Percentile
87.3
In the wild
Unconfirmed
What it is

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.

The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.03006 · 87.3th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2020-02-24T17:35Z
EPSS history
Timeline
  • 24 FEB 17:35Z
    Remote Code Execution (RCE) vulnerability in dropwizard-validation
    cvelistv5