JinJava Bypass through ForTag leads to Arbitrary Java Execution
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.9%
probabilidad de explotación
0.9%top 42% de las CVE
explotación observada
noninguna fuente lo reporta
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
HubSpot · jinjavaReferencias
https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74