Description
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat A-MQ Clients 2
Default version status: unaffected
Red Hat Cryostat 2
Default version status: unaffected
Red Hat Red Hat AMQ Broker 7
Default version status: unaffected
Red Hat Red Hat A-MQ Online
Default version status: unaffected
Red Hat Red Hat BPM Suite 6
Default version status: unknown
Red Hat Red Hat CodeReady Studio 12
Default version status: affected
Red Hat Red Hat Data Grid 8
Default version status: unaffected
Red Hat Red Hat Decision Manager 7
Default version status: unknown
Red Hat Red Hat Fuse 7
Default version status: unknown
Red Hat Red Hat JBoss BRMS 5
Default version status: unknown
Red Hat Red Hat JBoss Data Grid 7
Default version status: unknown
Red Hat Red Hat JBoss Data Virtualization 6
Default version status: unknown
Red Hat Red Hat JBoss Enterprise Application Platform 5
Default version status: unknown
Red Hat Red Hat JBoss Enterprise Application Platform 6
Default version status: unknown
Red Hat Red Hat JBoss Enterprise Application Platform 7
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform Continuous Delivery
Default version status: affected
Red Hat Red Hat JBoss Fuse 6
Default version status: unknown
Red Hat Red Hat JBoss Fuse Service Works 6
Default version status: unknown
Red Hat Red Hat JBoss Operations Network 3
Default version status: unknown
Red Hat Red Hat JBoss SOA Platform 5
Default version status: unknown
Red Hat Red Hat OpenStack Platform 10 (Newton)
Default version status: unknown
Red Hat Red Hat OpenStack Platform 13 (Queens)
Default version status: affected
Red Hat Red Hat Process Automation 7
Default version status: unknown
Red Hat Red Hat Satellite 6
Default version status: affected
Red Hat Red Hat Single Sign-On 7
Default version status: affected
Red Hat Red Hat support for Spring Boot
Default version status: unknown
Red Hat streams for Apache Kafka
Default version status: unaffected