CVE-2020-10693

Name of the Vulnerable Software and Affected Versions Hibernate Validator version 6.1.2.Final

Description A flaw was found in the message interpolation processor of Hibernate Validator, enabling invalid EL expressions to be evaluated as if they were valid. This allows attackers to bypass input sanitation controls that developers may have put in place when handling user-controlled data in error messages.

Recommendations For Hibernate Validator version 6.1.2.Final, consider disabling the message interpolation processor until a patch is available to prevent the evaluation of invalid EL expressions. Restrict the handling of user-controlled data in error messages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.