CVE-2020-12668

Name of the Vulnerable Software and Affected Versions Jinjava versions prior to 2.5.4

Description The issue allows access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could lead to abuse of the application class loader, including Arbitrary File Disclosure.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive classes and objects passed into the Jinjava context to minimize the risk of exploitation.