Template injection in cron-utils

高 8.1CVE-2020-26238 · GHSA-pfj3-56hm-jwq5 · 25/11/2020 公開 · 17/06/2026 更新

要点

CVE-2020-26238 は com.cronutils:cron-utils, cron-utils (cron-utils project) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.2%（全脆弱性の 91.0% より高い）。
対処：9.1.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.cronutils:cron-utils Maven	`< 9.1.3`	`9.1.3`
cron-utils cron-utils_project	`< 9.1.3`	`9.1.3`

概要

Impact

A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

Patches

The issue was patched and a new version released. Please upgrade to version 9.1.3.

Workarounds

There are no known workarounds up to this moment.

References

A description of the issue is provided in issue 461

For more information

If you have any questions or comments about this advisory:

Open an issue in cron-utils Github repository

NVD の説明

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

参考情報

com.cronutils:cron-utils のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン