CVE-2017-7536

Name of the Vulnerable Software and Affected Versions Hibernate Validator versions 5.2.x through 5.2.4, 5.3.x through 5.3.5, and 5.4.x through 5.4.1

Description A potential privilege escalation issue was found in Hibernate Validator when the security manager's reflective permissions are granted, allowing access to private class members. This could enable an attacker to validate an invalid instance and access private member values via ConstraintViolation#getInvalidValue().

Recommendations For Hibernate Validator version 5.2.x, update to version 5.2.5 final or later. For Hibernate Validator version 5.3.x, update to version 5.3.6 final or later. For Hibernate Validator version 5.4.x, update to version 5.4.2 final or later. As a temporary workaround, consider restricting the security manager's reflective permissions to prevent access to private class members.