CVE-2020-11002
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.17% probability · 92th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- dropwizard/dropwizard validation
- Source
- security-advisories@github.com
EPSS 5.2% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontextThird Party Advisory
- https://github.com/dropwizard/dropwizard/commit/d5a512f7abf965275f2a6b913ac4fe778e424242Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3208Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3209Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfExploit, Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-8jpx-m2wh-2v34Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/policy#reporting-a-vulnerabilityThird Party Advisory
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontextThird Party Advisory
- https://github.com/dropwizard/dropwizard/commit/d5a512f7abf965275f2a6b913ac4fe778e424242Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3208Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/pull/3209Patch, Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfExploit, Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-8jpx-m2wh-2v34Third Party Advisory
- https://github.com/dropwizard/dropwizard/security/policy#reporting-a-vulnerabilityThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.