CVE ID(s)

There's no CVE for this.

Report

I created a query to detect JNDI injections in Java code. The query raises a flag if a user-provided name is used in JNDI lookup. JNDI InitialContext as well as Spring's and Apache Shiro's JndiTemplate are supported.

The details are present in PR: github/codeql#3288

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing