High severity7.0NVD Advisory· Published Jan 10, 2018· Updated Jun 17, 2026
CVE-2017-7536
CVE-2017-7536
Description
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.hibernate:hibernate-validatorMaven | >= 5.2.0, < 5.2.5.Final | 5.2.5.Final |
org.hibernate:hibernate-validatorMaven | >= 5.3.0, < 5.3.6.Final | 5.3.6.Final |
org.hibernate:hibernate-validatorMaven | >= 5.4.0, < 5.4.2.Final | 5.4.2.Final |
Affected products
11- cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*Range: >=5.2.0,<5.2.5
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
- Red Hat, Inc./hibernate-validatorv5Range: 5.2.x before 5.2.5 final
Patches
Vulnerability mechanics
References
24- www.securityfocus.com/bid/101048nvdThird Party AdvisoryVDB EntryWEB
- www.securitytracker.com/id/1039744nvdThird Party AdvisoryVDB EntryWEB
- access.redhat.com/errata/RHSA-2017:2808nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2809nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2810nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2811nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3141nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3454nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3455nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3456nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3458nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2740nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2741nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2742nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2743nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2927nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:3817nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-xxgp-pcfc-3vgcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-7536ghsaADVISORY
- github.com/hibernate/hibernate-validator/commit/0778a5c98b817771a645c6f4ba0b28dd8b5437bghsaWEB
- github.com/hibernate/hibernate-validator/commit/0886e89900d343ea20fde5137c9a3086e6da9acghsaWEB
- lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3EghsaWEB
- lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Envd
News mentions
0No linked articles in our index yet.