CVE-2017-7536
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2017
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
hibernate-validator
- Vendor
- Red Hat, Inc.
- Product
- hibernate-validator
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.2.x before 5.2.5 final | affected | Unavailable | Unavailable | Unavailable | None listed |
| 5.3.x | affected | Unavailable | Unavailable | Unavailable | None listed |
| 5.4.x | affected | Unavailable | Unavailable | Unavailable | None listed |