A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2023-1932 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1809444 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
24 Jun 2025, 13:07
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:hibernate:hibernate-validator:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:continuous_delivery:*:*:* cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* |
|
| First Time |
Redhat codeready Studio
Redhat openstack Platform Redhat jboss Enterprise Application Platform Redhat Redhat single Sign-on Hibernate Hibernate hibernate-validator |
|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1809444 - Issue Tracking, Vendor Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2023-1932 - Vendor Advisory |
07 Nov 2024, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-07 10:15
Updated : 2025-06-24 13:07
NVD link : CVE-2023-1932
Mitre link : CVE-2023-1932
JSON object : View
Products Affected
redhat
- single_sign-on
- codeready_studio
- openstack_platform
- jboss_enterprise_application_platform
hibernate
- hibernate-validator
CWE
No CWE.