CVE-2023-1932

Published: Nov 7, 2024Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

Affected (6)

Products: Redhat: Codeready Studio, Jboss Enterprise Application Platform, Openstack Platform, Single Sign On · Hibernate: Hibernate Validator

Redhat

4 products

Codeready Studio

Jboss Enterprise Application Platform

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Codeready Studio	Version 12.0
Redhat Jboss Enterprise Application Platform	All versions
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Openstack Platform	Version 13.0
Redhat Single Sign On	Version 7.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Hibernate Hibernate Validator	Before 6.2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://access.redhat.com/security/cve/CVE-2023-1932

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1809444

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.