allegro/hermes · Security
hermes-management is vulnerable to RCE due to Apache commons-jxpath
- GHSA ID
- GHSA-2gh6-wc3m-g37f
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Impact
hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.
Patches
Upgrade Hermes to at least hermes-2.2.9
References
https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/
CWEs
- CWE-1395 · Dependency on Vulnerable Third-Party Component
References
- https://github.com/allegro/hermes/security/advisories/GHSA-2gh6-wc3m-g37f ↗
- https://github.com/allegro/hermes/commit/72ecc5aa41e37fd614443dd35d9200b66a61afb1 ↗
- https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852 ↗
- https://github.com/allegro/hermes/commit/92d4ad0cf6868ba784707772b78e129fedff7a31 ↗
- https://github.com/advisories/GHSA-2gh6-wc3m-g37f ↗