Lucene search

GoogleOSV:CVE-2023-26512

HistoryJul 17, 2023 - 8:15 a.m.

CVE-2023-26512

2023-07-1708:15:09

Google

osv.dev

cve-2023-26512 apache eventmesh remote code execution rabbitmq cwe-502 untrusted data fix update software windows linux macos

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

79.9%

JSON

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and

remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

CPENameOperatorVersion
eventmesheq1.8.0-rc2
eventmesheq1.7.0
eventmesheq1.8.0-rc1
eventmesheq1.8.0
eventmesheq1.7.0-rc1

Name	Operator	Version
eventmesh	eq	1.8.0-rc2
eventmesh	eq	1.7.0
eventmesh	eq	1.8.0-rc1
eventmesh	eq	1.8.0
eventmesh	eq	1.7.0-rc1

References

lists.apache.org/thread/zb1d62wh8o8pvntrnx4t1hj8vz0pm39p

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

79.9%

JSON

Related for OSV:CVE-2023-26512