Every CVE Search/ Get API key

CVE-2020-11002

Remote Code Execution (RCE) vulnerability in dropwizard-validation

8.0 HighFix available

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.17%Up 1.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.0

Remote Code Execution (RCE) vulnerability in dropwizard-validation

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

Record
CVE-2020-11002
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2020-0372 8.0

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

Record
EUVD-2020-0372
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-8jpx-m2wh-2v34 8.0

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary

A server-side template injection was identified in the self-validating (@SelfValidating) feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability.

If you're using a self-validating bean (via @SelfValidating), an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended.

The changes introduced in Dropwizard 1.3.19 and 2.0.2 (see GHSA-3mcp-9wr4-cjqf/CVE-2020-5245) unfortunately didn't fix the underlying issue completely.

Impact

This issue may allow Remote Code Execution (RCE), allowing to run arbitrary code on the host system (with the privileges of the Dropwizard service account privileges) by injecting arbitrary Java Expression Language (EL) expressions when using the self-validating feature (@SelfValidating, @SelfValidation) in dropwizard-validation.

Patches

The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

The evaluation of EL expressions has been disabled by default now.

In order to use some interpolation in the violation messages added to ViolationCollector, it has to be explicitly allowed by setting SelfValidating#escapeExpressions() to false.

It is also recommended to use the addViolation methods supporting message parameters instead of EL expressions introduced in Dropwizard 1.3.21 and 2.0.3:

Workarounds

If you are not able to upgrade to one of the aforementioned versions of dropwizard-validation but still want to use the @SelfValidating feature, make sure to properly sanitize any message you're adding to the…

Record
GHSA-8jpx-m2wh-2v34
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
NVD 8.0

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

Record
CVE-2020-11002
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-74
Updated
2026-11-02
OSV 8.8

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

Record
CVE-2020-11002
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-8jpx-m2wh-2v34 8.0

Remote Code Execution (RCE) vulnerability in dropwizard-validation

Summary

A server-side template injection was identified in the self-validating (@SelfValidating) feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability.

If you're using a self-validating bean (via @SelfValidating), an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended.

The changes introduced in Dropwizard 1.3.19 and 2.0.2 (see GHSA-3mcp-9wr4-cjqf/CVE-2020-5245) unfortunately didn't fix the underlying issue completely.

Impact

This issue may allow Remote Code Execution (RCE), allowing to run arbitrary code on the host system (with the privileges of the Dropwizard service account privileges) by injecting arbitrary Java Expression Language (EL) expressions when using the self-validating feature (@SelfValidating, @SelfValidation) in dropwizard-validation.

Patches

The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.

The evaluation of EL expressions has been disabled by default now.

In order to use some interpolation in the violation messages added to ViolationCollector, it has to be explicitly allowed by setting SelfValidating#escapeExpressions() to false.

It is also recommended to use the addViolation methods supporting message parameters instead of EL expressions introduced in Dropwizard 1.3.21 and 2.0.3:

Workarounds

If you are not able to upgrade to one of the aforementioned versions of dropwizard-validation but still want to use the @SelfValidating feature, make sure to properly sanitize any message you're adding to the…

Record
GHSA-8jpx-m2wh-2v34
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
io.dropwizard:dropwizard-validation
Maven
 before 1.3.21
1.3.21
io.dropwizard:dropwizard-validation
Maven
 2.0.0 up to 2.0.3
2.0.3
io.dropwizard:dropwizard-validation
Maven
 before 1.3.21, plus listed versions
0.7.00.7.0-rc10.7.0-rc20.7.0-rc30.7.1
Show 45 moreShow less
0.8.00.8.0-rc10.8.0-rc20.8.0-rc30.8.0-rc40.8.0-rc50.8.10.8.1-rc20.8.20.8.30.8.40.8.50.9.00.9.0-rc10.9.0-rc20.9.0-rc30.9.0-rc40.9.0-rc50.9.10.9.1-rc10.9.20.9.31.0.01.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.0-rc11.1.0-rc21.1.0-rc31.1.0-rc41.1.11.1.21.1.31.1.4
1.3.21
io.dropwizard:dropwizard-validation
Maven
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11002 is a high vulnerability (CVSS 8.0) in Dropwizard, published April 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.17%, the 92nd percentile. Fixed in io.dropwizard:dropwizard-validation 1.3.21.

References

This page doesn't list everything

Left out here: 48 versions and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open