New Plug-in for Detecting Command Execution Vulnerability in Weaver OA e-cology
Sep 19 2019
A new plug-in is released to detect the command execution vulnerability in Weaver OA e-cology. We recommend that you perform security checks.
Content
Target customers: users who use Weaver OA e-cology versions 7.0, 8.0, and 8.1. Features released: In Weaver OA e-cology, Resin is installed and the invoker servlet is enabled by default. The resin.conf file contains the configuration that allows users to invoke the servlet in CLASSPATH based on the class name when they access /weaver/className, thereby executing commands. We recommend that users of this component perform security checks.