Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access…
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Dromara
- Product
- Jpom
- CVSS v3.1
- 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-943
- NVD status
- Deferred
Why it ranks 33 (Notable)
- CVSS v3.1 9.8 critical
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.