| Package | Affected versions | Patched versions |
|---|---|---|
| com.browserup:browserup-proxy | < 2.1.2 | 2.1.2 |
| browserup proxy | < 2.1.2 | 2.1.2 |
A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282.
Effective Immediately, all users should upgrade to version 2.1.2 or higher.
None.
https://securitylab.github.com/research/bean-validation-RCE
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free