PT-2021-9464 · Jinjava · Jinjava

Alvaro Muñoz + 1 · Published 2021-02-19 · Updated 2022-02-09 · CVE-2020-12668

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jinjava versions prior to 2.5.4

Description The issue allows access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could lead to abuse of the application class loader, including Arbitrary File Disclosure.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive classes and objects passed into the Jinjava context to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-863

Related Identifiers

CVE-2020-12668

GHSA-2HJR-FG6C-V2H6

Affected Products

Jinjava

References · 9

• 🔥 https://securitylab.github.com/advisories/GHSL-2020-072-hubspot_jinjava · Exploit
• https://github.com/HubSpot/jinjava/pull/426/commits/5dfa5b87318744a4d020b66d5f7747acc36b213b · Patch
• https://github.com/HubSpot/jinjava/pull/435/commits/1b9aaa4b420c58b4a301cf4b7d26207f1c8d1165 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-12668 · Security Note
• https://osv.dev/vulnerability/GHSA-2hjr-fg6c-v2h6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12668 · Vendor Advisory
• https://github.com/HubSpot/jinjava/compare/jinjava-2.5.3...jinjava-2.5.4 · Note
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.5.4 · Note
• https://t.me/cvenotify/10191 · Telegram Post