CVE-2011-3923: Remote code execution via OGNL injention in HTTP parameter values
(updated )
OGNL provides, among other features, extensive expression evaluation capabilities. The vulnerability allows a malicious user to bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor
, thus being able to inject a malicious expression in any exposed string variable for further evaluation.
References
Detect and mitigate CVE-2011-3923 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →