CVE-2019-10219
Medium
Description
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Redhat Hibernate Validator
PublishedNov 8, 2019
First seenNov 8, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- redhat hibernate_validator6.0.18 or later
- oracle essbase11.1.2.4.47, 21.3 or later
- oracle essbase_administration_services11.1.2.4.47 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat hibernate_validator | v < 6.0.18, 6.1.0 | 6.0.18 |
| redhat fuse | 1.0 | — |
| redhat jboss_data_grid | No range specified | — |
| redhat jboss_enterprise_application_platform | No range specified, 7.2, 7.3 | — |
| redhat openshift_application_runtimes | No range specified | — |
| redhat single_sign-on | No range specified | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp management_services_for_element_software_and_netapp_hci | No range specified | — |
| netapp snapcenter_plug-in | No range specified | — |
| netapp element | No range specified | — |
| oracle access_manager | 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_product_lifecycle_analytics | 3.6.1 | — |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.6 | — |
| oracle agile_product_lifecycle_management_integration_pack | 3.6 | — |
| oracle airlines_data_model | 12.1.1.0.0, 12.2.0.1.0 | — |
| oracle application_express | 21.1.4 | — |
| oracle application_performance_management | 13.4.1.0, 13.5.1.0 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle argus_analytics | 8.2.1, 8.2.2, 8.2.3, 8.21 | — |
| oracle argus_insight | 8.2.1, 8.2.2, 8.2.3 | — |
| oracle argus_safety | 8.2.1, 8.2.2, 8.2.3 | — |
| oracle banking_apis | 18.1, 18.2, 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_deposits_and_lines_of_credit_servicing | 2.12.0 | — |
| oracle banking_digital_experience | 17.2, 18.1, 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_enterprise_default_management | 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0 | — |
| oracle banking_enterprise_default_managment | 2.3.0 ≤ v ≤ 2.4.0 | — |
| oracle banking_loans_servicing | 2.12.0 | — |
| oracle banking_party_management | 2.7.0 | — |
| oracle banking_platform | 2.3.0 ≤ v ≤ 2.4.1, 2.6.2, 2.7.0, 2.7.1 | — |
| oracle bi_publisher | 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle big_data_spatial_and_graph | 23.1 | — |
| oracle business_activity_monitoring | 12.2.1.4.0 | — |
| oracle business_intelligence | 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle business_process_management_suite | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle clinical | 5.2.1, 5.2.2 | — |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle commerce_platform | 11.3.0 ≤ v ≤ 11.3.2 | — |
| oracle communications_application_session_controller | 3.9.0 | — |
| oracle communications_billing_and_revenue_management | 12.0.0.3, 12.0.0.4 | — |
| oracle communications_billing_and_revenue_management_elastic_charging_engine | 11.3, 12.0 | — |
| oracle communications_calendar_server | 8.0.0.5.0, 8.0.0.6.0 | — |
| oracle communications_cloud_native_core_automated_test_suite | 1.8.0 | — |
| oracle communications_cloud_native_core_binding_support_function | 1.9.0, 1.10.0 | — |
| oracle communications_cloud_native_core_console | 1.7.0 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.9.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.14.0 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 1.5.0, 1.6.0, 1.15.0 | — |
| oracle communications_cloud_native_core_service_communication_proxy | 1.14.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.14.0 | — |
| oracle communications_contacts_server | 8.0.0.3.0 | — |
| oracle communications_converged_application_server_-_service_controller | 6.2 | — |
| oracle communications_convergence | 3.0.2.2.0 | — |
| oracle communications_convergent_charging_controller | 12.0.1.0.0 ≤ v ≤ 12.0.4.0.0, 6.0.1.0.0 | — |
| oracle communications_data_model | 11.3.2.1.0, 11.3.2.2.0, 11.3.2.3.0, 12.1.0.1.0, 12.1.2.0.0 | — |
| oracle communications_design_studio | 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2 | — |
| oracle communications_diameter_signaling_route | 8.0.0.0 ≤ v ≤ 8.5.1.0 | — |
| oracle communications_eagle_application_processor | 16.1 ≤ v ≤ 16.4 | — |
| oracle communications_instant_messaging_server | 10.0.1.5.0 | — |
| oracle communications_interactive_session_recorder | 6.3, 6.4 | — |
| oracle communications_messaging_server | 8.1 | — |
| oracle communications_metasolv_solution | 6.3.1 | — |
| oracle communications_network_charging_and_control | 12.0.1.0.0 ≤ v ≤ 12.0.4.0.0, 6.0.1.0.0 | — |
| oracle communications_network_integrity | 7.3.5, 7.3.6 | — |
| oracle communications_offline_mediation_controller | 12.0.0.3 | — |
| oracle communications_operations_monitor | 3.4, 4.2, 4.3, 4.4, 5.0 | — |
| oracle communications_pricing_design_center | 12.0.0.3.0, 12.0.0.4.0 | — |
| oracle communications_service_broker | 6.2 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_session_border_controller | 8.2, 8.3, 8.4, 9.0 | — |
| oracle communications_unified_inventory_management | 7.3.0, 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2, 7.5.0 | — |
| oracle communications_webrtc_session_controller | 7.2.0, 7.2.1 | — |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle database_server | 12.1.0.1, 12.1.0.2, 19c, 21c | — |
| oracle demantra_demand_management | 12.2.6 ≤ v ≤ 12.2.11 | — |
| oracle documaker | 12.6.0 ≤ v ≤ 12.6.4 | — |
| oracle e-business_suite | 12.2.3 ≤ v ≤ 12.2.11 | — |
| oracle enterprise_communications_broker | 3.3 | — |
| oracle enterprise_data_quality | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle enterprise_manager_base_platform | 13.4.0.0, 13.5.0.0 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle enterprise_session_border_controller | 8.4, 9.0 | — |
| oracle essbase | v < 11.1.2.4.47, 21.0 ≤ v < 21.3, 11.1.2.4.47 | 11.1.2.4.47, 21.3 |
| oracle essbase_administration_services | v < 11.1.2.4.47, 11.1.2.4.47 | 11.1.2.4.47 |
| oracle financial_services_analytical_applications_infrastructure | 8.0.7 ≤ v ≤ 8.1.1, 7.3.3 | — |
| oracle financial_services_behavior_detection_platform | 8.0.7, 8.0.8, 8.0.11 | — |
| oracle financial_services_enterprise_case_management | 8.0.7, 8.0.8, 8.0.11 | — |
| oracle financial_services_foreign_account_tax_compliance_act_management | 8.0.7, 8.0.8, 8.0.11 | — |
| oracle financial_services_model_management_and_governance | 8.0.8 ≤ v ≤ 8.1.1 | — |
| oracle financial_services_trade-based_anti_money_laundering | 8.0.7, 8.0.8 | — |
| oracle flexcube_investor_servicing | 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.4.0, 14.5.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle fusion_middleware | 12.2.1.3.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.