| Table of Contents |
|---|
...
March 2024
Reflected Cross-Site Scripting Vulnerability (XSS) in Userview
Description
In a userview, it is possible to send unvalidated data to a web browser when dynamically switching user locales, which can result in the browser executing malicious code.
Severity
High
Affected Versions
Joget DX 7.0.18 and below
Resolution
Upgrade to Joget DX 7.0.19 and above
...
April 2022
Critical Vulnerability in Spring Framework CVE-2022-22965
Description
| English |
|---|
| A critical vulnerability has been found in the Spring Framework. According to the vulnerability report CVE-2022-22965: |
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
...
- JDK 9 or higher
- Apache Tomcat as the Servlet container
- Packaged as WAR
- spring-webmvc or spring-webflux dependency
Severity
Critical
Affected
...
Versions
- Joget DX (7.0.27 and below) running on JDK 9+ and Apache Tomcat (8.5.77 and below, or 9.0.61 and below).
- Joget Workflow v6 (6.0.34 and below) running on JDK 9+ and Apache Tomcat (8.5.77 and below, or 9.0.61 and below)
Resolution
A fix is available in the latest upcoming Joget versions:
- Joget DX 7.0.28
- Joget Workflow v6 6.0.35
...
Critical Vulnerability in Apache Log4j CVE-2021-44228
Description
Critical vulnerability in Apache Log4j. According to the report CVE-2021-44228:
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Severity
Critical
Affected
...
Versions
The following versions use Apache Log4j 1.x:
...
However, this vulnerability only affects Apache Log4j versions from 2.0-beta9 to 2.14.1, so they are NOT affected by this vulnerability.
Resolution
To upgrade to the latest log4j 2 version, upgrade to the following Joget versions:
...