Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.browserup:browserup-proxy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 10.0MavenPublished

    Server-Side Template Injection

    CVE-2020-26282 · GHSA-wmfg-55f9-j8hq

    Affected
    • Maven com.browserup:browserup-proxy < 2.1.2
    Fixed in
    2.1.2· Vendor fix available
    Issue
    Impact A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282. Patches Effective Immediately, all users should upgrade to version 2.1.2 or higher. Workarounds None. References https://securitylab.github.com/research/bean-validation-RCE For more information If you have any questions or comments about this advisory: Open an issue in the BrowserUp Proxy repo Contact us via the BrowserUp website or email us at support@browserup.com

    Recommended action: Upgrade to 2.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →