CVE-2019-19899 Pebble Templates Improper Input Validation vulnerability
Attackers can bypass Class access restrictions in Pebble Templates by exploiting the forName method, potentially leading to further exploitation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19899?
CVE-2019-19899 is a critical vulnerability in n/a, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.
Weakness: CWE-862
Which versions are affected by CVE-2019-19899?
2 open source packages ship an affected version, including io.pebbletemplates:pebble-project. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.pebbletemplates:pebble-project Maven | All versions | 3.1.4 |
io.pebbletemplates:pebble-project Maven | All versions | 3.1.4 |
Products include Pebbletemplates Pebble Templates.
How do I fix CVE-2019-19899?
Upgrade io.pebbletemplates:pebble-project to 3.1.4 or later.
Is CVE-2019-19899 being exploited?
There is no known exploitation of CVE-2019-19899 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-83m8-7hj8-ff5w.