GitHub Advisoryadvisory · Maven

GHSA-wmfg-55f9-j8hq Server-Side Template Injection

HIGH Published 2020-12-24 Modified 2020-12-24 Official page ↗
Aliases
CVE-2020-26282
Ecosystem
Maven
Packages
com.browserup:browserup-proxy
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-74
Reviewed
2020-12-24

Affected packages

• Maven com.browserup:browserup-proxy: < 2.1.2 → fixed in 2.1.2

Description

Impact A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282. Patches Effective Immediately, all users should upgrade to version 2.1.2 or higher. Workarounds None. References https://securitylab.github.com/research/bean-validation-RCE For more information If you have any questions or comments about this advisory: • Open an issue in the BrowserUp Proxy repo • Contact us via the BrowserUp website or email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-26282 BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References