Information Exposure Affecting com.hubspot.jinjava:jinjava Open this link in a new tab package, versions [,2.5.4)
Attack Complexity
Low
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-COMHUBSPOTJINJAVA-1078235
-
published
21 Feb 2021
-
disclosed
21 Feb 2021
-
credit
Unknown
Introduced: 21 Feb 2021
CVE-2020-12668 Open this link in a new tabHow to fix?
Upgrade com.hubspot.jinjava:jinjava
to version 2.5.4 or higher.
Overview
com.hubspot.jinjava:jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates (at least the subset of jinja in use in HubSpot content).
Affected versions of this package are vulnerable to Information Exposure. It allows access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.