PT-2019-9664 · Hubspot · Jinjava

Boulter · Published 2019-01-03 · Updated 2019-10-03 · CVE-2018-18893

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jinjava versions prior to 2.4.6

Description The issue is related to the getClass method in Jinjava, specifically in the com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java file. This method is not properly blocked, which can lead to potential security issues.

Recommendations For versions prior to 2.4.6, update to version 2.4.6 or later to resolve the issue.

Fix

Related Identifiers

CVE-2018-18893

GHSA-45R8-3495-X6RM

Affected Products

Jinjava

References · 7

• https://github.com/HubSpot/jinjava/pull/230 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-18893 · Security Note
• https://osv.dev/vulnerability/GHSA-45r8-3495-x6rm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18893 · Vendor Advisory
• https://github.com/HubSpot/jinjava/blob/master/CHANGES.md · Note
• https://github.com/HubSpot/jinjava · Note
• https://github.com/advisories/GHSA-45r8-3495-x6rm · Note