Lucene search

GoogleOSV:CVE-2024-23682

HistoryJan 19, 2024 - 9:15 p.m.

CVE-2024-23682

2024-01-1921:15:10

Google

osv.dev

artemis java

test sandbox

vulnerability

sandbox escape

attacker

class files

package

ares

trust

arbitrary java

execution

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.

CPENameOperatorVersion
areseq0.3.1
areseq0.3.9
areseq1.3.1
areseq1.4.4
areseq1.2.0
areseq0.2.1
areseq1.3.3
areseq0.1.3
areseq0.3.8
areseq1.7.4

Name	Operator	Version
ares	eq	0.3.1
ares	eq	0.3.9
ares	eq	1.3.1
ares	eq	1.4.4
ares	eq	1.2.0
ares	eq	0.2.1
ares	eq	1.3.3
ares	eq	0.1.3
ares	eq	0.3.8
ares	eq	1.7.4

Rows per page:

1-10 of 711

References

github.com/advisories/GHSA-227w-wv4j-67h4

github.com/ls1intum/Ares/issues/15

github.com/ls1intum/Ares/releases/tag/1.8.0

github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4

vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:CVE-2024-23682