CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

• CWE-74
• CWE-74

• https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolationThird Party Advisory
• https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressionsThird Party Advisory
• https://docs.oracle.com/javaee/7/tutorial/jsf-el.htmThird Party Advisory
• https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
• https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634Patch, Third Party Advisory
• https://github.com/dropwizard/dropwizard/pull/3157Patch, Third Party Advisory
• https://github.com/dropwizard/dropwizard/pull/3160Patch, Third Party Advisory
• https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfExploit, Third Party Advisory
• https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolationThird Party Advisory
• https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressionsThird Party Advisory
• https://docs.oracle.com/javaee/7/tutorial/jsf-el.htmThird Party Advisory
• https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236
• https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634Patch, Third Party Advisory
• https://github.com/dropwizard/dropwizard/pull/3157Patch, Third Party Advisory
• https://github.com/dropwizard/dropwizard/pull/3160Patch, Third Party Advisory
• https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqfExploit, Third Party Advisory

Published

Feb 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5239In Mailu before version 1.7, an authenticated user can explo…8.8
• CVE-2020-5240In wagtail-2fa before 1.4.1, any user with access to the CMS…8.5
• CVE-2020-5241matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XS…5.4
• CVE-2020-5242openHAB before 2.5.2 allow a remote attacker to use REST cal…8.8
• CVE-2020-5243uap-core before 0.7.3 is vulnerable to a denial of service a…7.5
• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5
• CVE-2020-5246Traccar GPS Tracking System before version 4.9 has a LDAP in…6.5
• CVE-2020-5247In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an appl…7.5
• CVE-2020-5248GLPI before before version 9.4.6 has a vulnerability involvi…5.3
• CVE-2020-5249In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application…6.5
• CVE-2020-5250In PrestaShop before version 1.7.6.4, when a customer edits …6.3
• CVE-2020-5251In parser-server before version 4.1.0, you can fetch all the…5.3