-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability is clearly identified in two REST endpoint methods within the JaversEntityAuditResource class. Both methods use Class.forName() with user-supplied input (entityType and qualifiedName parameters) concatenated with the application's package name. This unsafe reflection allows loading arbitrary classes if an attacker can control these parameters and place malicious classes in the classpath. The functions are marked with high confidence as they are explicitly mentioned in the vulnerability details and the proof-of-concept. Both functions require ADMIN privileges to access, but once accessed, they can be exploited for remote code execution through static initializers in malicious classes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| generator-jhipster-entity-audit | npm | < 5.9.1 | 5.9.1 |
Ongoing coverage of React2Shell