CVEブラウザに戻る

CVE-2020-26238

HIGH

7.9

CVSS Severity Score

EPSS Score0.1770%

EPSS Percentile33.73th

Published2020年11月25日

Last Modified2024年11月21日

Vulnerability Description

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Affected Platforms (CPE)

📦

Cron Utils Project

Cron Utils

< 9.1.3

References & Advisories

🔗 https://github.com/jmrozanec/cron-utils/commit/4cf373f7352f5d95f0bf6512af8af326b31c835e

🔗 https://github.com/jmrozanec/cron-utils/issues/461

🔗 https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-pfj3-56hm-jwq5

🔗 https://lists.apache.org/thread.html/r390bb7630b7ea8f02bf7adbbe69c0ae8b562c527d663c543d965f959%40%3Cgitbox.hive.apache.org%3E

🔗 https://lists.apache.org/thread.html/r432a69a1a85cbcb1f1bad2aa0fbfce0367bf894bf917f6ed7118e7f0%40%3Cissues.hive.apache.org%3E

🔗 https://lists.apache.org/thread.html/r50e1b5544c37e408ed7e9a958b28237b1cb9660ba2b3dba46f343e23%40%3Cissues.hive.apache.org%3E

🔗 https://lists.apache.org/thread.html/r5f601d15292e3302ad0ae0e89527029546945b1cd5837af7e838d354%40%3Cdev.hive.apache.org%3E

🔗 https://lists.apache.org/thread.html/r71083c759dc627f198571b3d48b6745fe798b1d53c34f7ef8de9e7dd%40%3Cissues.hive.apache.org%3E

関連する脆弱性情報

CVE-2021-4126910.0

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In aff...

CVE-2020-079610.0

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles cer...

CVE-2020-195310.0

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes i...

CVE-2020-161410.0

A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, wh...