Description
Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.
Remediation
References
https://github.com/PebbleTemplates/pebble/issues/493
Related Vulnerabilities
CVE-2021-23337 Vulnerability in maven package org.fujion.webjars:lodash
CVE-2022-31129 Vulnerability in maven package org.webjars:momentjs
CVE-2020-7692 Vulnerability in maven package com.google.oauth-client:google-oauth-client
CVE-2020-28440 Vulnerability in npm package corenlp-js-interface
CVE-2017-16143 Vulnerability in npm package commentapp.stetsonwood