Description

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.

Remediation

References

https://github.com/jfinal/jfinal/issues/187

Related Vulnerabilities

CVE-2020-7610 Vulnerability in maven package org.webjars.npm:bson

CVE-2019-20149 Vulnerability in maven package org.webjars.npm:kind-of

CVE-2019-16772 Vulnerability in npm package serialize-javascript

CVE-2021-3597 Vulnerability in maven package io.undertow:undertow-core

CVE-2019-19771 Vulnerability in npm package bitcionjslib

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Third Party Advisory NVD-CWE-Other