CVE-2023-4528 JSCAPE MFT Server Unsafe Deserialization on Management Port

2023-09-0717:39:42

CWE-502

rapid7

www.cve.org

jscape mft server

unsafe deserialization

management interface

arbitrary code execution

os commands

cve-2023-4528

windows

linux

macos

0.001 Low

EPSS

Percentile

20.6%

JSON

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux"
    ],
    "product": "JSCAPE MFT Server",
    "vendor": "Redwood Software",
    "versions": [
      {
        "lessThan": "2023.1.9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]