[VELOCITY-849] Vulnerability Note

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 1.7
• Component/s: Engine
• Environment: Tomcat
• Assignee: Claude Brisson
• Reporter: Greg Huber
• Created: 14/May/14 07:46
• Updated: 07/Jan/18 15:48
• Resolved: 30/Aug/16 21:16

Description

Hello,
I was checking this vulnerability for struts against velocity and it looks like it may apply here also.

http://www.kb.cert.org/vuls/id/719225

When I use the code on my template:

$model.class.getClassLoader() I get the following:

WebappClassLoader context: /events delegate: false repositories: /WEB-INF/classes/ ----------> Parent Classloader: org.apache.catalina.loader.StandardClassLoader@47711479

I am not sure on what type of manipulation was used in the vulnerability, but on struts, this type of response has been blocked.

Cheers Greg