CVE-2020-26238

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

CVE-2020-26238

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

Design/Logic Flaw

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2, <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21, <=0.0.41) +245 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (>=2.0.0, <=9.1.2)

com.cronutils:cron-utils MAVEN version =2.0.0, =0.0.2, =0.0.21, =0.0.1, =1.0.30 - com.baomidou:jobs-spring-boot-starter 1.0.3 - com.cronutils:cron-utils-spring 1.0.1 - com.elastisys:autoscaler.core 5.2.2 - com.elastisys:autoscaler.distro.standard 5.2.2 -...

CVE-2020-26238 Critical vulnerability found in cron-utils

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

CVE-2020-26238

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2, <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21, <=0.0.41) +87 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (>=9.0.0, <=9.1.2)

com.cronutils:cron-utils MAVEN version =9.0.0, =0.0.2, =0.0.21, =0.0.1, =0.1.2, =0.0.1, =1.2.19, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2020-26238 Source advisory: OSV:GHSA-PFJ3-56HM-JWQ5...

de.viadee:viadeeprocessapplicationvalidator (2.2.1) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (6.0.2)

com.cronutils:cron-utils MAVEN version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - de.viadee:viadeeprocessapplicationvalidator 2.2.1 Source cves: CVE-2020-26238 Source advisory:...

de.viadee:viadeeprocessapplicationvalidator (>=2.2.3, <=2.4.0) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (6.0.3)

com.cronutils:cron-utils MAVEN version 6.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - de.viadee:viadeeprocessapplicationvalidator =2.2.3, =2.4.0 Source cves: CVE-2020-26238 Source advisory:...

com.github.anilganipineni:scheduler (>=0.1, <=0.4), com.github.shijingsh:shijingsh-ai-core (1.0.0) +29 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (8.0.0)

com.cronutils:cron-utils MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.github.anilganipineni:scheduler =0.1, =0.4 - com.github.shijingsh:shijingsh-ai-core 1.0.0 -...

de.viadee:viadeeprocessapplicationvalidator (>=2.7.1, <=3.0.4) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (7.0.6)

com.cronutils:cron-utils MAVEN version 7.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - de.viadee:viadeeprocessapplicationvalidator =2.7.1, =3.0.4 Source cves: CVE-2020-26238 Source advisory:...

GHSA-PFJ3-56HM-JWQ5 Template injection in cron-utils

Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...

de.skuzzle.inject:guice-async-extension (>=1.0.0, <=1.2.0) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (5.0.0)

com.cronutils:cron-utils MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - de.skuzzle.inject:guice-async-extension =1.0.0, =1.2.0 Source cves: CVE-2020-26238 Source advisory:...

com.northernwall:hadrian (>=1.6.14, <=1.9.1) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (5.0.1)

com.cronutils:cron-utils MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.northernwall:hadrian =1.6.14, =1.9.1 Source cves: CVE-2020-26238 Source advisory: OSV:GHSA-PFJ3-56HM-JWQ5...

com.tencent.bk.devops.ci.artifactory:api-artifactory-push (>=1.3.0-rc.15-release, <=1.6.0-rc.11-release), com.tencent.bk.devops.ci.artifactory:api-artifactory-sample (1.4.0-release) +43 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (7.0.1)

com.cronutils:cron-utils MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.tencent.bk.devops.ci.artifactory:api-artifactory-push =1.3.0-rc.15-release, =1.3.0-rc.7-release,...

com.walmartlabs.bigben:bigben-app (>=1.0.4, <=1.0.8), com.walmartlabs.bigben:bigben-cron (>=1.0.4, <=1.0.8) +3 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (7.0.2)

com.cronutils:cron-utils MAVEN version 7.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.walmartlabs.bigben:bigben-app =1.0.4, =1.0.4, =2.6.0, =2.7.0 Source cves: CVE-2020-26238 Source advisory:...

Template injection in cron-utils

Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...

com.elastisys:autoscaler.core (5.2.2), com.elastisys:autoscaler.distro.standard (5.2.2) +69 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (5.0.5)

com.cronutils:cron-utils MAVEN version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.elastisys:autoscaler.core 5.2.2 - com.elastisys:autoscaler.distro.standard 5.2.2 -...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2, <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21, <=0.0.41) +87 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (>=9.0.0, <=9.1.2)

com.cronutils:cron-utils MAVEN version =9.0.0, =0.0.2, =0.0.21, =0.0.1, =0.1.2, =0.0.1, =1.2.19, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2020-26238 Source advisory: GHSA-PFJ3-56HM-JWQ5...

org.hswebframework:hsweb-task-cluster (1.0.0-rc), org.hswebframework:hsweb-task-core (1.0.0-rc) +1 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (7.0.5)

com.cronutils:cron-utils MAVEN version 7.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - org.hswebframework:hsweb-task-cluster 1.0.0-rc - org.hswebframework:hsweb-task-core 1.0.0-rc -...