Threats affecting pkg:maven/Jpom

Jpom versions 2.10.0 through 2.11.12 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain super-administrator access by injecting specially crafted query conditions into the JPOM-USER-TOKEN header. The vulnerability arises because the Hutool Condition parser interprets injected values like 'is not null' as operators, enabling unauthorized command execution via Jpom's script features.