What is GHSA-83m8-7hj8-ff5w?

GHSA-83m8-7hj8-ff5w is a security advisory published by GitHub Security Advisories with Critical severity. Pebble Templates Improper Input Validation vulnerability

Which CVE IDs does GHSA-83m8-7hj8-ff5w cover?

GHSA-83m8-7hj8-ff5w covers the following CVE IDs: CVE-2019-19899. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-83m8-7hj8-ff5w?

GHSA-83m8-7hj8-ff5w has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-83m8-7hj8-ff5w?

GHSA-83m8-7hj8-ff5w affects 1 product, including: maven/io.pebbletemplates:pebble-project:\u003c 3.1.4.

GHSA-83m8-7hj8-ff5wCriticalCVSS 9.8

Pebble Templates Improper Input Validation vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-19899 →

📋 Description

Pebble Templates prior to 3.1.4 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.

🎯 Affected products1

maven/io.pebbletemplates:pebble-project:< 3.1.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-19899
https://github.com/PebbleTemplates/pebble/issues/493
https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble/
https://github.com/PebbleTemplates/pebble/pull/511
https://github.com/advisories/GHSA-83m8-7hj8-ff5w