Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/com.netflix.conductor/conductor-core@1.6.2-rc1
Typemaven
Namespacecom.netflix.conductor
Nameconductor-core
Version1.6.2-rc1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.25.4
Latest_non_vulnerable_version2.25.4
Affected_by_vulnerabilities
0
url VCID-91ej-zp5g-augd
vulnerability_id VCID-91ej-zp5g-augd
summary 
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Netflix Titus uses Java Bean Validation (JSR ) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-9296
reference_id
reference_type
scores
0
value 0.00563
scoring_system epss
scoring_elements 0.68764
published_at 2026-06-09T12:55:00Z
1
value 0.00563
scoring_system epss
scoring_elements 0.68719
published_at 2026-06-04T12:55:00Z
2
value 0.00563
scoring_system epss
scoring_elements 0.68759
published_at 2026-06-07T12:55:00Z
3
value 0.00563
scoring_system epss
scoring_elements 0.68767
published_at 2026-06-06T12:55:00Z
4
value 0.00563
scoring_system epss
scoring_elements 0.68744
published_at 2026-06-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-9296
1
reference_url https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-001.md
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-001.md
2
reference_url https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-9296
reference_id CVE-2020-9296
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-9296
4
reference_url https://github.com/advisories/GHSA-wfj5-2mqr-7jvv
reference_id GHSA-wfj5-2mqr-7jvv
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wfj5-2mqr-7jvv
fixed_packages
0
url pkg:maven/com.netflix.conductor/conductor-core@2.25.4
purl pkg:maven/com.netflix.conductor/conductor-core@2.25.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.netflix.conductor/conductor-core@2.25.4
aliases CVE-2020-9296, GHSA-wfj5-2mqr-7jvv
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-91ej-zp5g-augd
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/com.netflix.conductor/conductor-core@1.6.2-rc1