CVE-2020-26238highCWE-74

CVE-2020-26238: high-severity vulnerability in jmrozanec cron-utils

Critical vulnerability found in cron-utils

Published · Updated

Follow this CVE+ Monitor cron-utils+ Monitor com.cronutils:cron-utils

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.9epss 4.2%
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected products
jmrozanec · cron-utils
Related CVEs — jmrozanec cron-utils

In the same product, most dangerous first.

CVE-2021-41269CRITICALUnauthenticated remote code injection in cron-utilsEPSS 4.3%