Jinjava calls getClass

GHSA-45r8-3495-x6rm · CVE-2018-18893

Published Jan 4, 2019 · Modified Dec 4, 2024

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2018-18893
WEB https://github.com/HubSpot/jinjava/pull/230
PACKAGE https://github.com/HubSpot/jinjava
WEB https://github.com/HubSpot/jinjava/blob/master/CHANGES.md
ADVISORY https://github.com/advisories/GHSA-45r8-3495-x6rm

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Jinjava calls getClass

Description

References

More Maven vulnerabilities

Start Securing