{"id":"CVE-2021-31649","details":"In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute","aliases":["GHSA-h3j8-fr5q-8rfr"],"modified":"2026-07-09T00:14:11.883279Z","published":"2021-06-24T16:15:08.523Z","references":[{"type":"EVIDENCE","url":"http://note.youdao.com/noteshare?id=787ccbb8345dbd4a905aebe35f1d8aa8&sub=6C5C072C901949429EFD978405212FA4"},{"type":"EVIDENCE","url":"https://note.youdao.com/ynoteshare1/index.html?id=787ccbb8345dbd4a905aebe35f1d8aa8&type=note"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jfinal/jfinal","events":[{"introduced":"0"},{"last_affected":"2a248fca7239f46a63c28af7a37d3e18e4dd6a0f"}],"database_specific":{"cpe":"cpe:2.3:a:jfinal:jfinal:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"4.9.08"}],"source":"CPE_RANGE"}}],"versions":["jfinal-4.9.08","jfinal-4.9.06","jfinal-4.9.05","jfinal-4.9.04","jfinal-4.9.03","jfinal-4.9.02","jfinal-4.9","jfinal-4.8","jfinal-4.7","jfinal-4.6","jfinal-4.5","jfinal-4.4","jfinal-4.3","jfinal-4.2","jfinal-4.1","jfinal-4.0","jfinal-3.8","jfinal-3.7","jfinal-3.6","jfinal-3.5","jfinal-3.4","jfinal-3.3","jfinal-3.2","jfinal-3.1","jfinal-3.0","jfinal-2.2","jfinal-2.1","jfinal-2.0","jfinal-1.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31649.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}