Log in Start free

Vulnerability · Published Nov 24, 2020 · Assigned by GitHub_M

CVE-2020-26238Critical vulnerability found in cron-utils

High 7.9

In plain English

A high-severity injection in cron-utils from jmrozanec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.9High
Exploit odds (30 days)4.2%top 9.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavencom.cronutils:cron-utils9.1.3GHSA-pfj3-56hm-jwq5

Affected products (as reported)

VendorProductVersions
jmrozanec cron-utils < 9.1.3

Weakness: CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References