Executive Summary

This vulnerability exists in pig-mesh Pig versions 3.8.2 and below. It occurs in the Quartz management function under the system management module when setting up scheduled tasks. An attacker can exploit this by executing any Java class that has a parameterless constructor and methods with a String parameter type through reflection. Specifically, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute arbitrary commands, resulting in remote code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to remotely execute arbitrary code on the affected system. This means the attacker could potentially take full control of the system, execute malicious commands, access sensitive data, disrupt services, or use the system as a foothold for further attacks.

Useful 0 Not Useful 0