GHSA-279p-pc38-xx4pHighCVSS 7.5

JFinal file validation vulnerability

Published
May 25, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2019-17352 →

📋 Description

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.

🎯 Affected products1

  • maven/com.jfinal:jfinal:< 4.5

🔗 References (5)