---
identifier: "CVE-2021-41269"
identifiers:
- "CVE-2021-41269"
- "GHSA-p9m8-27x8-rg87"
package_slug: "maven/com.cronutils/cron-utils"
title: "Improper Control of Generation of Code ('Code Injection')"
description: "cron-utils is a Java library to define, parse, validate, migrate crons
  as well as get human readable descriptions for them. leading to unauthenticated
  Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this
  vulnerability."
date: "2021-11-19"
pubdate: "2021-11-15"
affected_range: "(,9.1.6)"
fixed_versions:
- "9.1.6"
affected_versions: "All versions before 9.1.6"
not_impacted: "All versions starting from 9.1.6"
solution: "Upgrade to version 9.1.6 or above."
urls:
- "https://nvd.nist.gov/vuln/detail/CVE-2021-41269"
- "https://github.com/jmrozanec/cron-utils/issues/461"
- "https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9da"
- "https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87"
- "https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899da"
cvss_v2: "AV:N/AC:M/Au:N/C:P/I:P/A:P"
cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
uuid: "768bd965-d9a9-471e-91ef-20ea320018a8"
cwe_ids:
- "CWE-1035"
- "CWE-937"
- "CWE-94"
