Description
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=1465573
https://access.redhat.com/errata/RHSA-2017:3458
https://access.redhat.com/errata/RHSA-2017:3456
https://access.redhat.com/errata/RHSA-2017:3455
https://access.redhat.com/errata/RHSA-2017:3454
https://access.redhat.com/errata/RHSA-2017:3141
https://access.redhat.com/errata/RHSA-2017:2811
https://access.redhat.com/errata/RHSA-2017:2810
https://access.redhat.com/errata/RHSA-2017:2809
https://access.redhat.com/errata/RHSA-2017:2808
http://www.securitytracker.com/id/1039744
http://www.securityfocus.com/bid/101048
https://access.redhat.com/errata/RHSA-2018:2743
https://access.redhat.com/errata/RHSA-2018:2742
https://access.redhat.com/errata/RHSA-2018:2741
https://access.redhat.com/errata/RHSA-2018:2740
https://access.redhat.com/errata/RHSA-2018:2927
https://access.redhat.com/errata/RHSA-2018:3817
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
Related Vulnerabilities
CVE-2022-36915 Vulnerability in maven package org.jenkins-ci.plugins:android-signing
CVE-2021-32640 Vulnerability in npm package ws
CVE-2013-2165 Vulnerability in maven package org.richfaces.framework:richfaces-impl-jsf2
CVE-2020-12827 Vulnerability in maven package org.webjars.npm:mjml
CVE-2021-41189 Vulnerability in maven package org.dspace:dspace-api