PT-2019-15992 · Pebble · Pebble Templates

Ismai1337

·

CVE-2019-19899

·

Publicado

2019-12-18

·

Atualizado

2022-05-24

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Pebble Templates versions prior to 3.1.4
Description The issue allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature. This enables potential exploitation by accessing sensitive classes.
Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue.

Exploit

Correção

Missing Authorization

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862CWE-20

Identificadores relacionados

CVE-2019-19899
GHSA-83M8-7HJ8-FF5W

Produtos afetados

Pebble Templates