Arbitrary code execution in jfinal CMS

2023-04-2821:30:19

Google

osv.dev

jfinal cms

arbitrary code execution

command execution vulnerability

actionenter class

ueditor route

software

0.0004 Low

EPSS

Percentile

5.7%

JSON

Command execution vulnerability in the ActionEnter Class ins jfinal CMS version 5.1.0 allows attackers to execute arbitrary code via a created json file to the ueditor route.

CPENameOperatorVersion
com.jflyfox:jflyfox_jfinaleq1.8
com.jflyfox:jflyfox_jfinaleq1.9
com.jflyfox:jflyfox_jfinaleq2.0
com.jflyfox:jflyfox_jfinaleq2.1
com.jflyfox:jflyfox_jfinaleq3.0
com.jflyfox:jflyfox_jfinaleq4.0
com.jflyfox:jflyfox_jfinaleq4.1
com.jflyfox:jflyfox_jfinaleq4.2
com.jflyfox:jflyfox_jfinaleq4.3
com.jflyfox:jflyfox_jfinaleq4.4

Name	Operator	Version
com.jflyfox:jflyfox_jfinal	eq	1.8
com.jflyfox:jflyfox_jfinal	eq	1.9
com.jflyfox:jflyfox_jfinal	eq	2.0
com.jflyfox:jflyfox_jfinal	eq	2.1
com.jflyfox:jflyfox_jfinal	eq	3.0
com.jflyfox:jflyfox_jfinal	eq	4.0
com.jflyfox:jflyfox_jfinal	eq	4.1
com.jflyfox:jflyfox_jfinal	eq	4.2
com.jflyfox:jflyfox_jfinal	eq	4.3
com.jflyfox:jflyfox_jfinal	eq	4.4