CVE-2017-7536

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-10 · updated 2026-06-17
Weakness: CWE-592

Description

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Affected products

Hibernate Validator: from 5.2.0 before 5.2.5; from 5.3.0 before 5.3.6; from 5.4.0 before 5.4.2 — fixed in 5.2.5, 5.3.6, 5.4.2
Red Hat JBoss EAP: 6.0.0, 6.4.0, 7.0, 7.1
Red Hat Satellite 6: 6.4
RedHat Satellite Capsule: 6.4
RedHat Virtualization: 4.0
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Hibernate Validator 5.2.5, 5.3.6, 5.4.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-7536 or the next vulnerability affects your stack