CVE-2020-10693

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-06 · updated 2026-06-17
Weakness: CWE-20

Description

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Affected products

IBM WebSphere Application Server: from 17.0.0.3 through 20.0.0.10
Oracle WebLogic Server: 14.1.1.0.0
quarkusio quarkus: through 1.4.2
Hibernate Validator: from 5.0.0 before 6.0.20; from 6.1.2 before 6.1.5; 7.0.0-alpha1 — fixed in 6.0.20, 6.1.5
Red Hat JBoss EAP: 7.2.0, 7.3.0
Red Hat Satellite 6: 6.8
RedHat Satellite Capsule: 6.8

How to fix

Upgrade to a fixed version: Hibernate Validator 6.0.20, 6.1.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-10693 or the next vulnerability affects your stack