CVE-2019-19899: Missing Authorization

May 24, 2022 (updated July 18, 2023)

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.

References

github.com/PebbleTemplates/pebble/issues/493
github.com/advisories/GHSA-83m8-7hj8-ff5w
nvd.nist.gov/vuln/detail/CVE-2019-19899
research.securitum.com/server-side-template-injection-on-the-example-of-pebble/

Detect and mitigate CVE-2019-19899 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →