CVE-2020-12668: GHSL-2020-072: Arbitrary file disclosure in JinJava - CVE-2020-12668
A user with privileges to write JinJava templates, for example in a CMS context, will be able to read arbitrary files from the file system.
Other sources
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12668?
CVE-2020-12668 is considered to have a high severity due to its potential for arbitrary file disclosure.
What versions of Jinjava are affected by CVE-2020-12668?
CVE-2020-12668 affects Jinjava versions prior to 2.5.4.
How do I fix CVE-2020-12668?
To fix CVE-2020-12668, upgrade Jinjava to version 2.5.4 or later.
What is the nature of the vulnerability described in CVE-2020-12668?
CVE-2020-12668 involves access to arbitrary classes that could lead to abusive use of the application class loader.
How can CVE-2020-12668 impact my application?
CVE-2020-12668 can allow attackers to exploit the application class loader, potentially leading to unauthorized access and information disclosure.