~ / search / GHSA-8m9f-c5p9-wqch

GHSA-8m9f-c5p9-wqch

Remote Code Execution in com.bstek.uflo:uflo-core

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-25894

Packages

EcosystemPackageAffectedFixed in
Maven com.bstek.uflo:uflo-core <= 2.1.5 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.

References

External links from the advisory. They lead to third-party sites.