GitHub Advisoryadvisory · Maven

GHSA-xpv2-8ppj-79hh Expression injection in AviatorScript

CRITICAL Published 2021-10-04 Modified 2024-02-20 Official page ↗

Aliases: CVE-2021-41862
Ecosystem: Maven
Packages: com.googlecode.aviator:aviator
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-74
Reviewed: 2021-10-04

Affected packages

• Maven com.googlecode.aviator:aviator: >= 5.2.1, <= 5.2.7 (no fix yet)

Description

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).

Related

Alias · CVE (1)

CVE-2021-41862 AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL). vulnerability

Weakness · CWE (1)

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References