Description

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

Remediation

References

https://issues.apache.org/jira/browse/SCB-2145

https://seclists.org/oss-sec/2021/q1/60

Related Vulnerabilities

CVE-2023-26143 Vulnerability in npm package blamer

CVE-2022-38749 Vulnerability in maven package org.yaml:snakeyaml

CVE-2023-1436 Vulnerability in maven package org.codehaus.jettison:jettison

CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-api

CVE-2021-41182 Vulnerability in npm package jquery-ui

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Patch Vendor Advisory Third Party Advisory