CVE-2020-12668

Katalog CVE

CVSS 6.5 · Medium EPSS 1,8%

Kerentanan Incorrect Authorization pada hubspot jinjava. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

Rincian

Terbit di NVD

19 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/HubSpot/jinjava/pull/426/commits/5dfa5b87318744a4d020b66d5f7747acc36b213b patch · permissions required · advisory pihak ketiga
• https://github.com/HubSpot/jinjava/pull/435/commits/1b9aaa4b420c58b4a301cf4b7d26207f1c8d1165 patch · advisory pihak ketiga
• https://github.com/HubSpot/jinjava/compare/jinjava-2.5.3...jinjava-2.5.4 release notes · advisory pihak ketiga
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.5.4 release notes · advisory pihak ketiga
• https://securitylab.github.com/advisories/GHSL-2020-072-hubspot_jinjava exploit · advisory pihak ketiga