9.8

CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netflix ≫ Titus Version <= 0.1.0
Netflix ≫ Titus Version0.1.1 Update-
Netflix ≫ Titus Version0.1.1 Updaterc244
Netflix ≫ Titus Version0.1.1 Updaterc260
Netflix ≫ Titus Version0.1.1 Updaterc261
Netflix ≫ Titus Version0.1.1 Updaterc262
Netflix ≫ Titus Version0.1.1 Updaterc263
Netflix ≫ Titus Version0.1.1 Updaterc264
Netflix ≫ Titus Version0.1.1 Updaterc265
Netflix ≫ Titus Version0.1.1 Updaterc266
Netflix ≫ Titus Version0.1.1 Updaterc267
Netflix ≫ Titus Version0.1.1 Updaterc268
Netflix ≫ Titus Version0.1.1 Updaterc269
Netflix ≫ Titus Version0.1.1 Updaterc270
Netflix ≫ Titus Version0.1.1 Updaterc271
Netflix ≫ Titus Version0.1.1 Updaterc272
Netflix ≫ Titus Version0.1.1 Updaterc273
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.564
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.