{"id":"GHSA-2gh6-wc3m-g37f","summary":"hermes-management is vulnerable to RCE due to Apache commons-jxpath","details":"### Impact\nhermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.\n\n### Patches\nUpgrade Hermes to at least hermes-2.2.9\n\n### References\nhttps://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/","modified":"2026-08-31T23:15:07.884111105Z","published":"2024-09-17T19:29:24Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-09-17T19:29:24Z","nvd_published_at":null,"cwe_ids":["CWE-1395"]},"references":[{"type":"WEB","url":"https://github.com/allegro/hermes/security/advisories/GHSA-2gh6-wc3m-g37f"},{"type":"WEB","url":"https://github.com/allegro/hermes/commit/72ecc5aa41e37fd614443dd35d9200b66a61afb1"},{"type":"WEB","url":"https://github.com/allegro/hermes/commit/92d4ad0cf6868ba784707772b78e129fedff7a31"},{"type":"PACKAGE","url":"https://github.com/allegro/hermes"},{"type":"WEB","url":"https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852"}],"affected":[{"package":{"name":"pl.allegro.tech.hermes:hermes-management","ecosystem":"Maven","purl":"pkg:maven/pl.allegro.tech.hermes/hermes-management"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.2"},{"fixed":"2.2.9"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.1","0.12.10","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.14.0","0.15.0","0.15.1","0.15.10-enable-setting-idle-connection-timeout-for-jetty-client","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.1","0.16.2","0.8.10","0.8.10-hotfix1","0.8.10-hotfix2","0.8.11","0.8.12","0.8.2","0.8.3","0.8.3-batch-delivery","0.8.3-hotfix1","0.8.4","0.8.5","0.8.5-hotfix1","0.8.5-hotfix2","0.8.6","0.8.6-hotfix1","0.8.6-hotfix2","0.8.6-hotfix3","0.8.6-hotfix4","0.8.6-hotfix5","0.8.7","0.8.7-hotfix1","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.2","1.10.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.14.0","1.14.1","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.7.0","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.6-batch-exceptions-logging","1.8.7","1.8.8","1.8.9","1.9.0","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.14","1.9.15","1.9.2","1.9.3","1.9.4","1.9.5-management-restTemplate-bean-for-EventAuditor","1.9.6","1.9.7","1.9.8","1.9.9","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-2gh6-wc3m-g37f/GHSA-2gh6-wc3m-g37f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}