What’s Vulnerable › Vulnerabilities
CVE-2020-5245: Remote Code Execution (RCE) vulnerability in dropwizard-validation
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-02-24 · updated 2026-06-17
- Weakness: CWE-74
Description
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Affected products
- dropwizard: before 1.3.19; from 2.0.0 before 2.0.2 — fixed in 1.3.19, 2.0.2
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
How to fix
Upgrade to a fixed version: dropwizard 1.3.19, 2.0.2; Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.
References
- https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions
- https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
- https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
- https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634
- https://github.com/dropwizard/dropwizard/pull/3157
- https://github.com/dropwizard/dropwizard/pull/3160
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf
- https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions
- https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
- https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
Get alerted when CVE-2020-5245 or the next vulnerability affects your stack