CVE-2020-5245 json
Remote Code Execution (RCE) vulnerability in dropwizard-validation
published 2020-02-24 6 y ago modified 2026-07-08 4 mo ago also GHSA-3mcp-9wr4-cjqf , EUVD-2020-0288
- cvss
- 7.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Patch / fix
- maven io.dropwizard:dropwizard-validation 1.3.19, 2.0.2
- dropwizard dropwizard_validation 1.3.19, 2.0.2
- oracle blockchain_platform 21.1.2
- github.com/dropwizard/dropwizard@28479f7 commit
- github.com/dropwizard/dropwizard@d87d1e4 commit
- github.com/dropwizard/dropwizard#3157 pull request
- github.com/dropwizard/dropwizard#3160 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
3.05% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
| GitHub | 3.1 | 7.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.dropwizard:dropwizard-validation | >=1.3.0-rc1, <1.3.19 >=2.0.0, <2.0.2 |
1.3.19 2.0.2 |
Affected products
- dropwizard dropwizard-validation
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/dropwizard/dropwizard/pull/3157
web, patch, third-party-advisory
-
github.com
/dropwizard/dropwizard/pull/3160
web, patch, third-party-advisory
-
github.com
/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
web
-
github.com
/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634
web, patch, third-party-advisory
-
github.com
/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf
web, exploit, third-party-advisory
-
beanvalidation.org
/2.0/spec/#validationapi-message-defaultmessageinterpolation
web, third-party-advisory
-
docs.jboss.org
/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions
web, third-party-advisory
-
docs.oracle.com
/javaee/7/tutorial/jsf-el.htm
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5245
advisory
-
github.com
/dropwizard/dropwizard
package
-
oracle.com
/security-alerts/cpuapr2022.html
web
Sources
- CVE List CVE-2020-5245
- GitHub Advisory GHSA-3mcp-9wr4-cjqf
- NVD CVE-2020-5245
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.