CVE-2024-0715

Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: before 8.8.7-03.

Weakness

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Potential Mitigations

• If user-controlled data must be added to an expression interpreter, one or more of the following should be performed:

References

• https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-112/index.html