Description
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.
Remediation
References
https://github.com/HubSpot/jinjava/blob/master/CHANGES.md
https://github.com/HubSpot/jinjava/pull/230
Related Vulnerabilities
CVE-2018-3719 Vulnerability in maven package org.webjars.npm:mixin-deep
CVE-2022-43401 Vulnerability in maven package org.jenkins-ci.plugins:script-security
CVE-2023-47320 Vulnerability in maven package org.silverpeas.core:silverpeas-core-war
CVE-2023-27848 Vulnerability in npm package broccoli-compass
CVE-2022-4245 Vulnerability in maven package org.codehaus.plexus:plexus-utils