Vulnerability Name:

CVE-2020-11002 (CCN-180592)

Assigned:2020-04-09
Published:2020-04-09
Updated:2020-04-13
Summary:dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-74
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-11002

Source: MISC
Type: Third Party Advisory
https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext

Source: XF
Type: UNKNOWN
dropwizardvalidatio-cve202011002-code-exec(180592)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/dropwizard/dropwizard/commit/d5a512f7abf965275f2a6b913ac4fe778e424242

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/dropwizard/dropwizard/pull/3208

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/dropwizard/dropwizard/pull/3209

Source: MISC
Type: Exploit, Third Party Advisory
https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf

Source: CCN
Type: Dropwizard GIT Repository
Remote Code Execution (RCE) vulnerability in dropwizard-validation <2.0.3

Source: CONFIRM
Type: Third Party Advisory
https://github.com/dropwizard/dropwizard/security/advisories/GHSA-8jpx-m2wh-2v34

Source: MISC
Type: Third Party Advisory
https://github.com/dropwizard/dropwizard/security/policy#reporting-a-vulnerability

Source: CCN
Type: IBM Security Bulletin 6606205 (Tivoli Netcool Manager)
There are multiple security vulnerabilities in Apache Storm used by IBM Tivoli Netcool Manager.

Vulnerable Configuration:Configuration 1:
  • cpe:/a:dropwizard:dropwizard_validation:*:*:*:*:*:*:*:* (Version < 1.3.21)
  • OR cpe:/a:dropwizard:dropwizard_validation:*:*:*:*:*:*:*:* (Version >= 2.0.0 and < 2.0.3)

    • * Denotes that component is vulnerable
    BACK
    dropwizard dropwizard validation *
    dropwizard dropwizard validation *