Описание
A flaw was found in the Apache Commons JXPath package. This flaw allows an attacker to use the interpreter to execute untrusted expressions and a remote code attack.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Migration Toolkit for Runtimes | JXPath | Affected | ||
| Red Hat Decision Manager 7 | JXPath | Not affected | ||
| Red Hat Enterprise Linux 7 | apache-commons-jxpath | Affected | ||
| Red Hat Fuse 7 | JXPath | Will not fix | ||
| Red Hat Integration Camel K 1 | JXPath | Not affected | ||
| Red Hat Integration Camel Quarkus 1 | JXPath | Not affected | ||
| Red Hat JBoss Data Grid 7 | JXPath | Out of support scope | ||
| Red Hat JBoss Data Virtualization 6 | JXPath | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 7 | commons-jxpath | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | commons-jxpath | Not affected |
Показывать по
Дополнительная информация
Статус:
9.8 Critical
CVSS3
Связанные уязвимости
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions
Уязвимость функций класса JXPathContext (кроме compile и compilePath) библиотеки обработки объектных запросов JXPath, позволяющая нарушителю выполнить произвольный код
9.8 Critical
CVSS3