high7.5
CVE-2020-26565
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter.
Impact
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Objectplanet | Opinio | before 7.14 |
Weakness classification
References
- NVD record
- CVE.org record
- https://packetstormsecurity.com/files/163708/ObjectPlanet-Opinio-7.13-Expression-Language-Injection.html
- https://www.objectplanet.com/opinio/changelog.html
- https://packetstormsecurity.com/files/163708/ObjectPlanet-Opinio-7.13-Expression-Language-Injection.html
- https://www.objectplanet.com/opinio/changelog.html