GitHub Advisoryadvisory · Maven

GHSA-2c25-xfpq-8w9r Cross-site scripting in jfinal

MEDIUM Published 2021-08-13 Modified 2021-07-01 Official page ↗
Aliases
CVE-2021-33348
Ecosystem
Maven
Packages
com.jfinal:jfinal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-06-25

Affected packages

• Maven com.jfinal:jfinal: < 4.9.11 → fixed in 4.9.11

Description

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.

Related

Alias · CVE (1)

  • CVE-2021-33348 An issue was discovered in JFinal framework v4.9.10 and below. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References