CVE-2018-18893

Description

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

Affected packages (1)

• Maven/com.hubspot.jinjava:jinjavafrom 0, < 2.4.6

CVSS scores

References (5)

• ADVISORYhttps://github.com/advisories/GHSA-45r8-3495-x6rm
• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-18893
• PATCHhttps://github.com/HubSpot/jinjava
• WEBhttps://github.com/HubSpot/jinjava/blob/master/CHANGES.md
• WEBhttps://github.com/HubSpot/jinjava/pull/230