Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the processing of JEXL expressions when the JexlContextBuilder name denylist can be bypassed with a one-hop navigation. An attacker can obtain sensitive information from linked accounts or managers by crafting...