Global infos:

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

CVE Status: Modified

References:

[email protected]

[email protected]

af854a3a-2127-422b-91ae-364da2661108

af854a3a-2127-422b-91ae-364da2661108

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	NETWORK
Availability Impact	HIGH
Base Score	10
Base Severity	CRITICAL
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Privileges Required	NONE
Scope	CHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability Score	3.9
Impact Score	6
Source	[email protected]
Type	Secondary

Links:

Exploit-db
Github