CVE-2025-35036

216.73.217.17

· Published 03/06/2025 20:15 · Modified 04/06/2025 14:54

Labels: CVE-2025-35036 2025-06-03 9119a7d8-5eab-497f-8521-727c672e3725 CVE-2025-35036 CWE-94

Essential information

Published: 03/06/2025 20:15
Modified: 04/06/2025 14:54
Author: —
Creator: —
CVSS: 6.9 MEDIUM (v3) 6.9 MEDIUM (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD: View on NVD

Affected products (CPE)

Product	CPE
hibernate / validator	`cpe:2.3:a:hibernate:validator::::::::`
hibernate / validator	`cpe:2.3:a:hibernate:validator:6.2.0:::::::*`
hibernate / validator	`cpe:2.3:a:hibernate:validator:7.0.0:::::::*`