{"id":"GHSA-x83m-pf6f-pf9g","summary":"hibernate-validator Cross-site Scripting vulnerability","details":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","aliases":["CVE-2023-1932"],"modified":"2025-09-12T20:26:21.781124Z","published":"2024-11-07T12:30:34Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-11-07T18:00:00Z","nvd_published_at":"2024-11-07T10:15:04Z","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1932"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2023-1932"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809444"},{"type":"PACKAGE","url":"https://github.com/hibernate/hibernate-validator"}],"affected":[{"package":{"name":"org.hibernate.validator:hibernate-validator","ecosystem":"Maven","purl":"pkg:maven/org.hibernate.validator/hibernate-validator"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0.Final"}]}],"versions":["6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.CR2","6.0.0.CR3","6.0.0.Final","6.0.1.Final","6.0.10.Final","6.0.11.Final","6.0.12.Final","6.0.13.Final","6.0.14.Final","6.0.15.Final","6.0.16.Final","6.0.17.Final","6.0.18.Final","6.0.19.Final","6.0.2.Final","6.0.20.Final","6.0.21.Final","6.0.22.Final","6.0.23.Final","6.0.3.Final","6.0.4.Final","6.0.5.Final","6.0.6.Final","6.0.7.Final","6.0.8.Final","6.0.9.Final","6.1.0.Alpha1","6.1.0.Alpha2","6.1.0.Alpha3","6.1.0.Alpha4","6.1.0.Alpha5","6.1.0.Alpha6","6.1.0.Final","6.1.1.Final","6.1.2.Final","6.1.3.Final","6.1.4.Final","6.1.5.Final","6.1.6.Final","6.1.7.Final","6.2.0.CR1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-x83m-pf6f-pf9g/GHSA-x83m-pf6f-pf9g.json"}},{"package":{"name":"org.hibernate:hibernate-validator","ecosystem":"Maven","purl":"pkg:maven/org.hibernate/hibernate-validator"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0.Final"}]}],"versions":["3.0.0.GA","3.0.0.ga","3.1.0.CR1","3.1.0.CR2","3.1.0.GA","4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.GA","4.0.1.GA","4.0.2.GA","4.1.0.Beta1","4.1.0.Beta2","4.1.0.CR1","4.1.0.Final","4.2.0.Beta1","4.2.0.Beta2","4.2.0.CR1","4.2.0.Final","4.3.0.Alpha1","4.3.0.Beta1","4.3.0.CR1","4.3.0.Final","4.3.1.Final","4.3.2.Final","5.0.0.Alpha1","5.0.0.Alpha2","5.0.0.Beta1","5.0.0.CR1","5.0.0.CR2","5.0.0.CR3","5.0.0.CR4","5.0.0.CR5","5.0.0.Final","5.0.1.Final","5.0.2.Final","5.0.3.Final","5.1.0.Alpha1","5.1.0.Beta1","5.1.0.CR1","5.1.0.Final","5.1.1.Final","5.1.2.Final","5.1.3.Final","5.2.0.Alpha1","5.2.0.Beta1","5.2.0.CR1","5.2.0.Final","5.2.1.Final","5.2.2.Final","5.2.3.Final","5.2.4.Final","5.2.5.Final","5.3.0.Alpha1","5.3.0.CR1","5.3.0.Final","5.3.1.Final","5.3.2.Final","5.3.3.Final","5.3.4.Final","5.3.5.Final","5.3.6.Final","5.4.0.Beta1","5.4.0.CR1","5.4.0.Final","5.4.1.Final","5.4.2.Final","5.4.3.Final","6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.CR2","6.0.0.CR3","6.0.0.Final","6.0.1.Final","6.0.10.Final","6.0.11.Final","6.0.12.Final","6.0.13.Final","6.0.14.Final","6.0.15.Final","6.0.16.Final","6.0.17.Final","6.0.18.Final","6.0.19.Final","6.0.2.Final","6.0.20.Final","6.0.21.Final","6.0.22.Final","6.0.23.Final","6.0.3.Final","6.0.4.Final","6.0.5.Final","6.0.6.Final","6.0.7.Final","6.0.8.Final","6.0.9.Final","6.1.0.Alpha1","6.1.0.Alpha2","6.1.0.Alpha3","6.1.0.Alpha4","6.1.0.Alpha5","6.1.0.Alpha6","6.1.0.Final","6.1.1.Final","6.1.2.Final","6.1.3.Final","6.1.4.Final","6.1.5.Final","6.1.6.Final","6.1.7.Final","6.2.0.CR1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-x83m-pf6f-pf9g/GHSA-x83m-pf6f-pf9g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}