CVE-2021-37694: Code injection issue for java-spring-cloud-stream-template
@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@asyncapi/java-spring-cloud-stream-templateto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37694?
The severity of CVE-2021-37694 is high with a CVSS score of 8.7.
How do I fix CVE-2021-37694?
To remediate CVE-2021-37694, upgrade to versions 0.7.0 or higher of the @asyncapi/java-spring-cloud-stream-template.
What does CVE-2021-37694 impact?
CVE-2021-37694 impacts the @asyncapi/java-spring-cloud-stream-template, allowing for code injection if the AsyncAPI document is controlled by an attacker.
Is there a workaround for CVE-2021-37694?
There are no mitigations or workarounds available for CVE-2021-37694; upgrading is the only solution.
What type of vulnerability is CVE-2021-37694 classified as?
CVE-2021-37694 is classified as a code injection vulnerability.