NuytsTech Security

CVE-2020-12668

by ·

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

Date published : 2021-02-19

https://github.com/HubSpot/jinjava/compare/jinjava-2.5.3…jinjava-2.5.4

https://github.com/HubSpot/jinjava/pull/426/commits/5dfa5b87318744a4d020b66d5f7747acc36b213b

Tags: