CVE-2023-1932

Fixed upstream EPSS <1%CVSS 6.1

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

Published 2024-11-07 · CVE record · OSV

Products: Red Hat A-MQ Clients 2, Red Hat Cryostat 2, Red Hat AMQ Broker 7, Red Hat A-MQ Online, Red Hat BPM Suite 6, Red Hat CodeReady Studio 12, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss BRMS 5, Red Hat JBoss Data Grid 7, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 5, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Continuous Delivery, Red Hat JBoss Fuse 6, Red Hat JBoss Fuse Service Works 6, Red Hat JBoss Operations Network 3, Red Hat JBoss SOA Platform 5, Red Hat OpenStack Platform 10 (Newton), Red Hat OpenStack Platform 13 (Queens), Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Single Sign-On 7, Red Hat support for Spring Boot, Red Hat streams for Apache Kafka

Fixed upstream

Distro releases