CVE-2021-31635: 
Java vulnerability analysis and mitigation

Server-Side Template Injection (SSTI) vulnerability was discovered in jFinal version 4.9.08. The vulnerability was assigned CVE-2021-31635 and was disclosed on April 15, 2021. This vulnerability affects the template function in jFinal, a Java web framework (NVD, GitHub Issue).

The vulnerability is classified as a Server-Side Template Injection (SSTI) that exists in the template function of jFinal v.4.9.08. The CVSS v3.1 Base Score is 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited remotely without requiring privileges or user interaction (NVD).

The vulnerability allows remote attackers to execute arbitrary code via the template function. Given the CVSS score of 9.8, this indicates critical severity with high impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability can be exploited remotely by an attacker without requiring any privileges or user interaction. The specific details of the exploitation were not publicly disclosed due to security concerns (GitHub Issue).

Users should upgrade from jFinal version 4.9.08 to a patched version. The vulnerability was reported through the project's issue tracking system on both GitHub and Gitee platforms (GitHub Issue).