CVE-2020-26238
High
Description
Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
SeverityHigh
CVSS7.9
Exploit probability—
ProductCron-utils
PublishedNov 25, 2020
First seenNov 25, 2020
Weakness typeCWE-74Injection
How to fix
Update
- cron-utils_project cron-utils9.1.3 or later
- com.cronutils:cron-utils9.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cron-utils_project cron-utils | v < 9.1.3 | 9.1.3 |
| com.cronutils:cron-utilsMaven | v < 9.1.3 | 9.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.