Lucene search

GoogleOSV:CVE-2023-35839

HistoryJun 19, 2023 - 1:15 a.m.

CVE-2023-35839

2023-06-1901:15:08

Google

osv.dev

cve-2023-35839

bypass

component sofa-hessian

solon

arbitrary code execution

crafted payload.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.

CPENameOperatorVersion
soloneq1.6.12
soloneq2.3.0
soloneq2.1.1
soloneq1.6.23
soloneq1.11.5
soloneq1.5.40
soloneq2.3.1
soloneq2.2.12
soloneq1.12.4
soloneq1.4.1

Name	Operator	Version
solon	eq	1.6.12
solon	eq	2.3.0
solon	eq	2.1.1
solon	eq	1.6.23
solon	eq	1.11.5
solon	eq	1.5.40
solon	eq	2.3.1
solon	eq	2.2.12
solon	eq	1.12.4
solon	eq	1.4.1

Rows per page:

1-10 of 911

References

github.com/noear/solon/compare/v2.3.2...v2.3.3

github.com/noear/solon/issues/145

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

Related for OSV:CVE-2023-35839