CVE-2024-5828

Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.

Weakness

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Potential Mitigations

• If user-controlled data must be added to an expression interpreter, one or more of the following should be performed:

References

• https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-140/index.html