Back to CVE records
Medium 6.5HealthcarePublished Nov 8, 2019
CVE-2019-10219A vulnerability was found in Hibernate-Validator.
Updated under an hour ago ()
Does this affect you?
It affects hibernate-validator and 59 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 2.16%, higher than 82% of scored CVEs.
Do this next
Start free and add your stack
Free account, 1 product
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
- CVSS
- 6.5 MEDIUM (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 2.16% (percentile 82)
- Assigned by
- redhat
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Hibernate hibernate-validator hibernate:validator (from the name) | from 6.0.0.Alpha1 through 6.0.17.Final; from 6.1.0.Alpha1 through 6.1.0.Alpha6; 6.0.18.Final builds before 6.0.* not affected; from 6.1.0.Final not affected | CNA record |
redhat hibernate_validator redhat:hibernate_validator | before 6.0.18; 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0 | NVD |
redhat fuse redhat:fuse | 1.0 | NVD |
redhat jboss_data_grid redhat:jboss_data_grid | all versions | NVD |
redhat jboss_enterprise_application_platform redhat:jboss_enterprise_application_platform | all versions; 7.2; 7.3 | NVD |
redhat openshift_application_runtimes redhat:openshift_application_runtimes | all versions | NVD |
redhat single_sign-on redhat:single_sign-on | all versions | NVD |
netapp active_iq_unified_manager netapp:active_iq_unified_manager | all versions; all versions; all versions | NVD |
netapp management_services_for_element_software_and_netapp_hci netapp:management_services_for_element_software_and_netapp_hci | all versions | NVD |
netapp snapcenter_plug-in netapp:snapcenter_plug-in | all versions | NVD |
netapp element netapp:element | all versions | NVD |
oracle access_manager oracle:access_manager | 11.1.2.3.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle agile_product_lifecycle_analytics oracle:agile_product_lifecycle_analytics | 3.6.1 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.3; 9.3.6 | NVD |
oracle agile_product_lifecycle_management_integration_pack oracle:agile_product_lifecycle_management_integration_pack | 3.6 | NVD |
oracle airlines_data_model oracle:airlines_data_model | 12.1.1.0.0; 12.2.0.1.0 | NVD |
oracle application_express oracle:application_express | 21.1.4 | NVD |
oracle application_performance_management oracle:application_performance_management | 13.4.1.0; 13.5.1.0 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle argus_analytics oracle:argus_analytics | 8.2.1; 8.2.2; 8.2.3; 8.21 | NVD |
oracle argus_insight oracle:argus_insight | 8.2.1; 8.2.2; 8.2.3 | NVD |
oracle argus_safety oracle:argus_safety | 8.2.1; 8.2.2; 8.2.3 | NVD |
oracle banking_apis oracle:banking_apis | 18.1; 18.2; 18.3; 19.1; 19.2; 20.1; 21.1 | NVD |
oracle banking_deposits_and_lines_of_credit_servicing oracle:banking_deposits_and_lines_of_credit_servicing | 2.12.0 | NVD |
oracle banking_digital_experience oracle:banking_digital_experience | 17.2; 18.1; 18.3; 19.1; 19.2; 20.1; 21.1 | NVD |
oracle banking_enterprise_default_management oracle:banking_enterprise_default_management | 2.6.2; 2.7.0; 2.7.1; 2.10.0; 2.12.0 | NVD |
oracle banking_enterprise_default_managment oracle:banking_enterprise_default_managment | from 2.3.0 through 2.4.0 | NVD |
oracle banking_loans_servicing oracle:banking_loans_servicing | 2.12.0 | NVD |
oracle banking_party_management oracle:banking_party_management | 2.7.0 | NVD |
oracle banking_platform oracle:banking_platform | from 2.3.0 through 2.4.1; 2.6.2; 2.7.0; 2.7.1 | NVD |
oracle bi_publisher oracle:bi_publisher | 5.5.0.0.0; 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle big_data_spatial_and_graph oracle:big_data_spatial_and_graph | 23.1 | NVD |
oracle business_activity_monitoring oracle:business_activity_monitoring | 12.2.1.4.0 | NVD |
oracle business_intelligence oracle:business_intelligence | 5.5.0.0.0; 5.9.0.0.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle business_process_management_suite oracle:business_process_management_suite | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle clinical oracle:clinical | 5.2.1; 5.2.2 | NVD |
oracle commerce_guided_search oracle:commerce_guided_search | 11.3.2 | NVD |
oracle commerce_platform oracle:commerce_platform | from 11.3.0 through 11.3.2 | NVD |
oracle communications_application_session_controller oracle:communications_application_session_controller | 3.9.0 | NVD |
oracle communications_billing_and_revenue_management oracle:communications_billing_and_revenue_management | 12.0.0.3; 12.0.0.4 | NVD |
oracle communications_billing_and_revenue_management_elastic_charging_engine oracle:communications_billing_and_revenue_management_elastic_charging_engine | 11.3; 12.0 | NVD |
oracle communications_calendar_server oracle:communications_calendar_server | 8.0.0.5.0; 8.0.0.6.0 | NVD |
oracle communications_cloud_native_core_automated_test_suite oracle:communications_cloud_native_core_automated_test_suite | 1.8.0 | NVD |
oracle communications_cloud_native_core_binding_support_function oracle:communications_cloud_native_core_binding_support_function | 1.9.0; 1.10.0 | NVD |
oracle communications_cloud_native_core_console oracle:communications_cloud_native_core_console | 1.7.0 | NVD |
oracle communications_cloud_native_core_network_function_cloud_native_environment oracle:communications_cloud_native_core_network_function_cloud_native_environment | 1.9.0 | NVD |
oracle communications_cloud_native_core_network_repository_function oracle:communications_cloud_native_core_network_repository_function | 1.14.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.14.0 | NVD |
oracle communications_cloud_native_core_security_edge_protection_proxy oracle:communications_cloud_native_core_security_edge_protection_proxy | 1.5.0; 1.6.0; 1.15.0 | NVD |
oracle communications_cloud_native_core_service_communication_proxy oracle:communications_cloud_native_core_service_communication_proxy | 1.14.0 | NVD |
oracle communications_cloud_native_core_unified_data_repository oracle:communications_cloud_native_core_unified_data_repository | 1.14.0 | NVD |
oracle communications_contacts_server oracle:communications_contacts_server | 8.0.0.3.0 | NVD |
oracle communications_converged_application_server_-_service_controller oracle:communications_converged_application_server_-_service_controller | 6.2 | NVD |
oracle communications_convergence oracle:communications_convergence | 3.0.2.2.0 | NVD |
oracle communications_convergent_charging_controller oracle:communications_convergent_charging_controller | from 12.0.1.0.0 through 12.0.4.0.0; 6.0.1.0.0 | NVD |
oracle communications_data_model oracle:communications_data_model | 11.3.2.1.0; 11.3.2.2.0; 11.3.2.3.0; 12.1.0.1.0; 12.1.2.0.0 | NVD |
oracle communications_design_studio oracle:communications_design_studio | 7.3.4; 7.3.5; 7.4.0; 7.4.1; 7.4.2 | NVD |
oracle communications_diameter_signaling_route oracle:communications_diameter_signaling_route | from 8.0.0.0 through 8.5.1.0 | NVD |
oracle communications_eagle_application_processor oracle:communications_eagle_application_processor | from 16.1 through 16.4 | NVD |
References
- https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3Emailing-list, x-refsource-mlist
- https://access.redhat.com/errata/RHSA-2020:0164vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0159vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0160vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0161vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0445vendor-advisory, x-refsource-redhat, third-party-advisory
- https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc, third-party-advisory
- https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fepatch
- https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceepatch
- https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219exploit
- https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploitexploit
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219x-refsource-confirm, issue-tracking, third-party-advisory
- https://security.netapp.com/advisory/ntap-20220210-0024/x-refsource-confirm, third-party-advisory
- https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.