CVE-2023-25581

🗓️ 10 Oct 2024 15:49:28Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 54 Views🌐 WEB

pac4j-core prior to version 4.0.0 Java deserialization vulnerability

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2023-25581	15 Oct 202423:51	–	githubexploit
Circl	CVE-2023-25581	10 Oct 202419:16	–	circl
CNNVD	pac4j 代码问题漏洞	10 Oct 202400:00	–	cnnvd
Cvelist	CVE-2023-25581 Deserialization of untrusted data in InternalAttributeHandler in pac4j	10 Oct 202415:49	–	cvelist
EUVD	EUVD-2024-2974	10 Oct 202415:49	–	euvd
F5 Networks	K000148598: pac4j vulnerability CVE-2023-25581	18 Nov 202417:39	–	f5
Github Security Blog	pac4j-core affected by a Java deserialization vulnerability	11 Oct 202422:16	–	github
NVD	CVE-2023-25581	10 Oct 202416:15	–	nvd
OSV	CVE-2023-25581 Deserialization of untrusted data in InternalAttributeHandler in pac4j	10 Oct 202415:49	–	osv
OSV	GHSA-76MW-6P95-X9X5 pac4j-core affected by a Java deserialization vulnerability	11 Oct 202422:16	–	osv

Vulners

Vulnrichment

Node

pac4j pac4jRange<4.0.0

[
  {
    "vendor": "pac4j",
    "product": "pac4j",
    "versions": [
      {
        "version": "< 4.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.github.com/advisories/GHSL-2022-085_pac4j/
github	www.github.com/frohoff/ysoserial
portswigger	www.portswigger.net/web-security/deserialization
github	www.github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java

Parameter	Position	Path	Description	CWE
UserProfile attribute containing a serialized Java object with {#sb64} and Base64-encoded payload	path	vulnerable-app.com/api/profile	Deserialization vulnerability in pac4j-core (CVE-2023-25581) allowing remote code execution via crafted serialized data	CWE-502