CVE-2020-12668

MEDIUM6.5EPSS 0.33%

Unauthorized access to Class instance in Jinjava

Published: 2/9/2022Modified: 11/8/2023
Also known as:GHSA-2hjr-fg6c-v2h6

Description

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (6)