CVE-2023-1932: fallo de gravedad media en Red Hat A-MQ Clients 2
Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss
Publicada el
Seguir esta CVE+ Monitorear Red Hat Single Sign-On+ Monitorear Red Hat JBoss Enterprise Application Platform
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.5%
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Red Hat · A-MQ Clients 2Red Hat · Cryostat 2Red Hat · Red Hat AMQ Broker 7Red Hat · Red Hat A-MQ OnlineRed Hat · Red Hat BPM Suite 6Red Hat · Red Hat CodeReady Studio 12Red Hat · Red Hat Data Grid 8Red Hat · Red Hat Decision Manager 7Red Hat · Red Hat Fuse 7Red Hat · Red Hat JBoss BRMS 5Red Hat · Red Hat JBoss Data Grid 7Red Hat · Red Hat JBoss Data Virtualization 6Red Hat · Red Hat JBoss Enterprise Application Platform 5Red Hat · Red Hat JBoss Enterprise Application Platform 6Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform Continuous DeliveryRed Hat · Red Hat JBoss Fuse 6Red Hat · Red Hat JBoss Fuse Service Works 6Red Hat · Red Hat JBoss Operations Network 3Red Hat · Red Hat JBoss SOA Platform 5Red Hat · Red Hat OpenStack Platform 10 (Newton)Red Hat · Red Hat OpenStack Platform 13 (Queens)Red Hat · Red Hat Process Automation 7Red Hat · Red Hat Satellite 6Red Hat · Red Hat Single Sign-On 7Red Hat · Red Hat support for Spring BootRed Hat · streams for Apache KafkaCVEs relacionadas — Red Hat A-MQ Clients 2
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.4%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.7%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-1132HIGHKeycloak: path transversal in redirection validationEPSS 1.6%CVE-2022-4244HIGHCodehaus-plexus: directory traversalEPSS 1.3%