3 ms·

So these guys have issued a new report for an issue first announced/reported in 2011? I'm missing what new discovery they've made, beyond the misleading count

So these guys have issued a new report for an issue first announced/reported in 2011? I'm missing what new discovery they've made, beyond the misleading count of how many people have downloaded the jars from a maven repository.

matdrewin 14y ago
Yeah, I guess they are just re-interating that a lot of people are still on 3.0.5 and they might want to look at upgrading. Here's the original article: http://www.mindedsecurity.com/fileshare/ExpressionLanguageInjection.pdf http://www.mindedsecurity.com/fileshare/ExpressionLanguageIn...