Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2020-11-24T23:50:12
Updated: 2024-08-04T15:56:04.555Z
Reserved: 2020-10-01T00:00:00
Link: CVE-2020-26238
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-11-25T00:15:10.747
Modified: 2024-11-21T05:19:37.353
Link: CVE-2020-26238
Redhat