CVE-2019-8341: opensuse leap Improper Control of Generation of Code

Vulnerability summary

CVE-2019-8341 is a critical (CVSS 9.8) Improper Control of Generation of Code vulnerability in opensuse leap. EPSS estimates a 43.87% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-02-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

• CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.