Threats tagged 'maven'

Apache Kylin versions 4.0.0 through 5.0.2 are affected by an authentication bypass vulnerability (CVE-2025-61733). This flaw allows an attacker to bypass authentication using an alternate path or channel. The issue is fixed in version 5.0.3, which users are advised to upgrade to.

QOS.CH logback-core versions prior to 1.5.19 and 1.3.16 are vulnerable to an arbitrary code execution flaw in conditional configuration file processing. Exploitation requires the presence of the Janino library and Spring Framework on the class path, as well as write access to a logback configuration file or the ability to inject a malicious environment variable. The vulnerability allows attackers with existing privileges to execute arbitrary code by compromising or injecting configuration files.

Apache ZooKeeper versions 3.9.0 through 3.9.3 have an insufficient permission check vulnerability in the AdminServer's snapshot and restore commands. Authenticated clients with lower privileges than intended can invoke these commands, potentially disclosing cluster state information. The issue is fixed in version 3.9.4.

Apache IoTDB versions from 1.3.3 through 1.3.4 and from 2.0.1-beta through 2.0.4 contain a denial of service (DoS) vulnerability. This issue is addressed in version 2.0.5, which users are advised to upgrade to in order to mitigate the risk.

A critical deserialization vulnerability (CVE-2025-6544) affects h2oai/h2o-3 versions up to 3.46.0.7. It allows attackers to read arbitrary system files and execute arbitrary code by exploiting improper handling of JDBC connection parameters. The vulnerability can be triggered by bypassing regular expression checks and using double URL encoding.

### Summary jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as `getClass()`, and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). ### Details jinjava templates expose a built-in variable `____int3rpr3t3r____`, which provides direct access to the jinjavaInterpreter instance. This variable was previously abused and protections were added to prevent call method from `JinjavaInterpreter` instances (see [Add interpreter to blacklist](https://github.com/HubSpot/jinjava/commit/1b9aaa4b420c58b4a301cf4b7d26207f1c8d1165)). However, interacting with the properties of `JinjavaInterpreter` instances remains [unrestricted](https://github.com/HubSpot/jinjava/blob/jinjava-2.8.0/src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java#L80-L84). From `____int3rpr3t3r____`, it is possible to traverse to the `config` field, which exposes an ObjectMapper. By invoking `readValue(String content, JavaType valueType)` on this ObjectMapper, an attacker can instantiate arbitrary classes specified via `JavaType`. Although jinjava explicitly restricts dangerous classes such as `Class`, `ClassLoader`, and so on inside `JinjavaBeanELResolver`, the `JavaType` class itself is [not restricted](https://github.com/HubSpot/jinjava/blob/jinjava-2.8.0/src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java#L246-L262). As a result, an attacker can leverage `JavaType` construction (`constructFromCanonical`) to instantiate semi-arbitrary classes without directly calling restricted methods. This allows sandbox escape and the creation of powerful primitives. ### Impact Escape the Jinjava sandbox and instantiate a wide range of classes using JavaType. This capability can be used to read arbitrary files and to perform full read SSRF by creating network-related objects. In certain environments, depending on the available classes, this primitive can even lead to complete remote code execution.

Jenkins versions 2.527 and earlier, including LTS 2.516.2 and earlier, have a log message injection vulnerability where user-controlled input in log messages can include line break characters. This allows attackers to insert forged log entries that may mislead administrators. Fixed in Jenkins 2.516.3 and 2.528 by adding indicators for inserted line breaks in log output.

Jenkins versions 2.527 and earlier, including LTS 2.516.2 and earlier, have a vulnerability where the authenticated user profile dropdown menu does not perform a permission check. This flaw allows attackers without Overall/Read permission to gather limited information about the Jenkins configuration, such as the presence of certain plugins. The issue is fixed in Jenkins versions 2.516.3 and 2.528, which require Overall/Read permission to access these menu items.

Jenkins versions 2.527 and earlier, including LTS 2.516.2 and earlier, have a missing permission check in the sidepanel of a page accessible to users without Overall/Read permission. This flaw allows unauthorized users to list agent names via the sidepanel executors widget. The issue is fixed in Jenkins 2.516.3 and 2.528 by removing the vulnerable sidepanel from the affected view.

A Cross-site Scripting (XSS) vulnerability exists in the Search widget of Liferay Portal versions 7.4.3.93 through 7.4.3.111 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4. This flaw allows remote attackers to inject arbitrary web scripts or HTML via a specific userId parameter. The vulnerability is fixed in version 8.0.93.

Apache Fory versions prior to 0.12.2 contain a vulnerability due to insecure deserialization of untrusted data. This flaw allows a remote attacker to supply a crafted payload that causes excessive CPU consumption during deserialization, leading to denial of service (DoS). Upgrading to version 0.12.2 or later mitigates the issue.

Apache DolphinScheduler versions prior to 3.2.2 contain an improper input validation vulnerability that allows an authenticated user to execute arbitrary shell scripts on the server via alert scripts. This vulnerability is addressed in version 3.2.2 and later.

Apache Jackrabbit Core and JCR Commons versions from 1.0.0 up to 2.22.1 are vulnerable to deserialization of untrusted data via JNDI URI lookups. This vulnerability allows attackers who can supply JNDI URIs to inject malicious references, potentially leading to arbitrary code execution. The issue is fixed in version 2.22.2, where JCR lookup through JNDI is disabled by default. Users relying on this feature must explicitly enable it and carefully review their usage.

A vulnerability in the fs2-io library on the JVM can cause a CPU spin loop during the TLS handshake if one side of a connection half-shuts down the socket write while the peer awaits more data. This results in high CPU usage until the connection is closed, enabling a denial of service attack by exhausting server resources. The issue affects fs2-io versions prior to 3.12.2 and 3.13.0-M7, as well as versions before 2.5.13. No workarounds exist, but patches are available in fixed versions.

A directory traversal vulnerability in the XWiki platform webjars API allows unauthorized access to configuration files by exploiting URL encoding and decoding inconsistencies. This can expose sensitive configuration data. The issue affects multiple versions prior to 16.10.7 and 17.4.0-rc-1 and has been patched in those releases. No workaround other than upgrading is available.

Jenkins OpenTelemetry Plugin versions 3.1543.v8446b_92b_cd64 and earlier contain a missing permission check vulnerability. This flaw allows users with Overall/Read permission to connect to attacker-specified URLs using credentials IDs that the attacker has obtained by other means, potentially capturing stored Jenkins credentials. A fix is available in version 3.1543.1545.vf5a.

The Jenkins global-build-stats Plugin versions 322.v22f4db_18e2dd and earlier lack permission checks on their REST API endpoints. This flaw allows attackers with Overall/Read permission to enumerate graph IDs. The issue has been fixed in version 347.v32a.

A file system information disclosure vulnerability exists in Jenkins Git client Plugin versions 6.3.2 and earlier. The flaw allows attackers with Overall/Read permission to infer the existence of files on the Jenkins controller by observing differences in Git URL field validation responses when using the amazon-s3 protocol with JGit. This vulnerability was fixed in version 6.3.3.

A vulnerability in the remove function of the Jobs Handler component in Xuxueli xxl-job up to version 3.1.1 allows improper control of resource identifiers via manipulation of the ID argument. This flaw enables remote attackers with limited privileges to potentially disrupt service or affect resource integrity. The issue is fixed in version 3.2.0. The vulnerability has a CVSS score of 5.4 (medium severity).

A vulnerability in Xuxueli xxl-job versions prior to 3.2.0 affects the getJobsByGroup function in JobLogController.java. This flaw allows improper control of resource identifiers via manipulation of the jobGroup argument, leading to resource injection and authorization bypass. The vulnerability can be exploited remotely and has been publicly disclosed. A fix is available in version 3.2.0.