Code injection

2021-01-2510:16:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.1%

JSON

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

CPENameOperatorVersion
java_chassisge2.0.0
java_chassislt2.1.5

CPE	Name	Operator	Version
	java_chassis	ge	2.0.0
	java_chassis	lt	2.1.5

References

issues.apache.org/jira/browse/SCB-2145

seclists.org/oss-sec/2021/q1/60