9.3
Critique
CVE-2026-120201 Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
Description
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jpom 2.10 | 2.10.0 → 2.11.12 | Pas de correctif indiqué |
Autres CVE de Jpom
Les 5 CVE de Jpom →
CVE-2026-120461
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves…
8.7
Élevée
CVE-2026-120460
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to…
8.7
Élevée
CVE-2026-111605
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated…
8.6
Élevée
CVE-2026-91993
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list…
5.3
Moyenne