Arbitrary Class Access Issue in Jinjava by HubSpot
CVE-2020-12668
6.5MEDIUM
What is CVE-2020-12668?
Jinjava versions prior to 2.5.4 are susceptible to a vulnerability that enables access to arbitrary classes by executing Java methods on objects within a Jinjava context. This flaw could result in the misuse of the application’s class loader, potentially allowing an attacker to disclose sensitive files arbitrarily. It is crucial for users of Jinjava to update to version 2.5.4 or later to mitigate this risk.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved