Description

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).

Remediation

References

https://github.com/killme2008/aviatorscript/issues/421

Related Vulnerabilities

CVE-2020-28482 Vulnerability in npm package fastify-csrf

CVE-2021-32820 Vulnerability in npm package express-handlebars

CVE-2021-4329 Vulnerability in maven package org.webjars.npm:json-logic-js

CVE-2021-3766 Vulnerability in npm package objection

CVE-2020-14446 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor.ui

Severity

Critical

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory