CVE-2023-51079

2023-12-2721:15:08

[email protected]

web.nvd.nist.gov

mvel 2.5.0.final

parsetools.subcompileexpression

java class lookups

vendor dispute

cve-2023-51079

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.001 Low

EPSS

Percentile

20.0%

JSON

A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because “the only thing that you could expect is that the parser will take a crazy amount of time to complete its task.”