Activiti
Monthly
Code injection in Alfresco Activiti through 7.21.0-rc.692 lets an authenticated low-privileged user who can route input into JuelScriptEngine.eval execute attacker-supplied JUEL expressions, potentially leading to remote code execution on the server. The vendor was contacted but did not respond, and no public exploit or fixed release has been identified at time of analysis. The supplied CVSS 4.0 base score is 5.3 (medium), while the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the higher potential impact if the reachable evaluator permits arbitrary Java invocation; the trigger feature or field that feeds eval is not described in the available sources.
Code injection in Alfresco Activiti through 7.21.0-rc.692 lets an authenticated low-privileged user who can route input into JuelScriptEngine.eval execute attacker-supplied JUEL expressions, potentially leading to remote code execution on the server. The vendor was contacted but did not respond, and no public exploit or fixed release has been identified at time of analysis. The supplied CVSS 4.0 base score is 5.3 (medium), while the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the higher potential impact if the reachable evaluator permits arbitrary Java invocation; the trigger feature or field that feeds eval is not described in the available sources.