GHSA-fv3m-xhqw-9m79

Suggest an improvement
Source
https://github.com/advisories/GHSA-fv3m-xhqw-9m79
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-fv3m-xhqw-9m79/GHSA-fv3m-xhqw-9m79.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fv3m-xhqw-9m79
Aliases
Published
2022-04-27T21:05:15Z
Modified
2023-11-08T04:08:39.417859Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ballcat-codegen template engine remote code execution injection
Details

Impact

Ballcat Codegen provides the function of online editing code to generate templates. In version < 1.0.0.beta.2, since Velocity and freemarker templates are introduced but input verification is not done, attackers can implement remote code execution through malicious code injection of the template engine.

Patches

The fault is rectified and needs to be upgraded to the latest version.

Database specific 
{
    "nvd_published_at": "2022-04-26T16:15:00Z",
    "github_reviewed_at": "2022-04-27T21:05:15Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20",
        "CWE-78"
    ]
}
References

Affected packages

Maven / com.hccake:ballcat-codegen

Package

Name
com.hccake:ballcat-codegen
View open source insights on deps.dev
Purl
pkg:maven/com.hccake/ballcat-codegen

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.0.beta.2

Affected versions

0.*

0.0.1

Database specific 

{
    "last_known_affected_version_range": "<= 1.0.0.beta.1"
}