CVE-2019-19899

CRITICAL

Pebble Templates < 3.1.4 - Missing Authorization via Class.forName Bypass

Title source: llm

Description

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/PebbleTemplates/pebble/issues/493

Scores

CVSS v3 9.8

EPSS 0.0128

EPSS Percentile 66.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-862

Status published

Products (2)

io.pebbletemplates/pebble-project 0 - 3.1.4Maven

pebbletemplates/pebble_templates 3.1.2

Published Dec 19, 2019

Tracked Since Feb 18, 2026