{"api_version":"1","generated_at":"2026-07-24T00:32:23+00:00","cve":"CVE-2020-5245","urls":{"html":"https://cve.report/CVE-2020-5245","api":"https://cve.report/api/cve/CVE-2020-5245.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-5245","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-5245"},"summary":{"title":"CVE-2020-5245","description":"Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2020-02-24 18:15:00","updated_at":"2022-05-12 15:00:00"},"problem_types":["CWE-74"],"metrics":[],"references":[{"url":"https://github.com/dropwizard/dropwizard/pull/3157","name":"https://github.com/dropwizard/dropwizard/pull/3157","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Escape EL expressions in ViolationCollector by joschi · Pull Request #3157 · dropwizard/dropwizard · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","name":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update Advisory - April 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm","name":"https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm","refsource":"MISC","tags":["Third Party Advisory"],"title":"9 Expression Language (Release 7)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation","name":"https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation","refsource":"MISC","tags":["Third Party Advisory"],"title":"Bean Validation specification","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/dropwizard/dropwizard/pull/3160","name":"https://github.com/dropwizard/dropwizard/pull/3160","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Escape EL expressions in ViolationCollector by joschi · Pull Request #3160 · dropwizard/dropwizard · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions","name":"https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions","refsource":"MISC","tags":["Third Party Advisory"],"title":"Hibernate Validator 6.1.4.Final - Jakarta Bean Validation Reference Implementation: Reference Guide","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634","name":"https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Escape EL expressions in ViolationCollector (#3157) · dropwizard/dropwizard@d87d1e4 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf","name":"https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf","refsource":"CONFIRM","tags":["Exploit","Third Party Advisory"],"title":"Remote Code Execution (RCE) vulnerability in dropwizard-validation <2.0.2 · Advisory · dropwizard/dropwizard · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5245","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5245","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"5245","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dropwizard","cpe5":"dropwizard_validation","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5245","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dropwizard","cpe5":"dropwizard_validation","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5245","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"blockchain_platform","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-5245","qid":"982422","title":"Java (maven) Security Update for io.dropwizard:dropwizard-validation (GHSA-3mcp-9wr4-cjqf)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2020-5245","STATE":"PUBLIC","TITLE":"Remote Code Execution (RCE) vulnerability in dropwizard-validation"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"dropwizard-validation","version":{"version_data":[{"version_value":"< 1.3.19"},{"version_value":">= 2.0.0, < 2.0.2"}]}}]},"vendor_name":"dropwizard"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}]},"references":{"reference_data":[{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"name":"https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf","refsource":"CONFIRM","url":"https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf"},{"name":"https://github.com/dropwizard/dropwizard/pull/3157","refsource":"MISC","url":"https://github.com/dropwizard/dropwizard/pull/3157"},{"name":"https://github.com/dropwizard/dropwizard/pull/3160","refsource":"MISC","url":"https://github.com/dropwizard/dropwizard/pull/3160"},{"name":"https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634","refsource":"MISC","url":"https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634"},{"name":"https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation","refsource":"MISC","url":"https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation"},{"name":"https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions","refsource":"MISC","url":"https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions"},{"name":"https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm","refsource":"MISC","url":"https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm"}]},"source":{"advisory":"GHSA-3mcp-9wr4-cjqf","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-02-24 18:15:00","lastModifiedDate":"2022-05-12 15:00:00","problem_types":["CWE-74"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":9},"severity":"HIGH","exploitabilityScore":8,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dropwizard:dropwizard_validation:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.19","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dropwizard:dropwizard_validation:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.2","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*","versionEndExcluding":"21.1.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"5245","Ordinal":"165459","Title":"CVE-2020-5245","CVE":"CVE-2020-5245","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"5245","Ordinal":"1","NoteData":"Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"5245","Ordinal":"2","NoteData":"2020-02-24","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"5245","Ordinal":"3","NoteData":"2020-02-24","Type":"Other","Title":"Modified"}]}}}