WS-2020-0455

Affected versions of this package are vulnerable to Server-side Template Injection SSTI. By allowing user input into java.security.ProtectionDomain.getClassLoader, templates will get access to the java classloader. This can be further leveraged for file system access and code execution. A...