by Kastro
Paper/Archive/CVE-2022-25894

CVE-2022-25894

snyk — All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via…

EPSS 3%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.2.852 × 2017.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.

Affected

ProductAffectedFixed inSource
com.bstek.uflo:uflo-coreall versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JAVA-COMBSTEKUFLO-3091112refgithub.com/youseries/uflo/blob/b3e198bc6523e5a6ba69edd84ba10e05a3b78726/uflo-core/src/main/java/com/bstek/uflo/expr/impl/ExpressionContextImpl.java%23L126reffmyyy1.github.io/2022/10/23/uflo2rce