CVE-2019-20155

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management (CLM) version 5.4

Description An issue in report edit.jsp allows any authenticated user to execute Groovy code when generating a report. This results in arbitrary code execution on the underlying server.

Recommendations For version 5.4, consider restricting access to the report edit.jsp page until a fix is available, and avoid generating reports from untrusted sources to minimize the risk of exploitation.