PT-2019-6379 · Red Hat+4 · Hibernate Validator+4

Publicado 2019-03-27 · Atualizado 2025-09-29 · CVE-2019-10219

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hibernate Validator (affected versions not specified)

Description The issue is related to the SafeHtml validator in Hibernate Validator, which fails to properly sanitize HTML content. This can lead to an XSS attack when an attacker sends malicious code in HTML comments or instructions. The vulnerability can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2021-3241

ALT-PU-2022-1082

ALT-PU-2022-1083

ALT-PU-2022-1084

ALT-PU-2022-1085

ALT-PU-2022-1086

ALT-PU-2022-1182

ALT-PU-2022-1183

ALT-PU-2022-1184

ALT-PU-2022-1185

ALT-PU-2022-1186

ALT-PU-2022-2171

ALT-PU-2023-1912

ALT-PU-2023-4088

ALT-PU-2023-4089

ALT-PU-2023-4090

ALT-PU-2023-4664

ALT-PU-2023-4665

ALT-PU-2023-4729

ALT-PU-2023-4730

BDU:2023-05424

CVE-2019-10219

GHSA-M8P2-495H-CCMH

OESA-2021-1332

RHSA-2020:0159

RHSA-2020:0160

RHSA-2020:0161

RHSA-2020:4366

Produtos afetados

Alt Linux

Debian

Hibernate Validator

Red Os

Virtualbox

Referências · 46

• 🔥 https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit · Exploit
• 🔥 https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219 · Exploit
• https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe · Correção
• https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee · Correção
• https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee · Nota
• https://github.com/hibernate/hibernate-validator · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10219 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6@%3Cnotifications.accumulo.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2020:0159 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1332 · Nota
• https://vuldb.com/ru/?id.145250 · Nota
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Aviso do Fabricante
• https://oracle.com/security-alerts/cpujan2022.html · Nota
• https://access.redhat.com/errata/RHSA-2020:0161 · Aviso do Fabricante