CVE-2023-49396

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/save...

CVE-2023-49396

creationtimestamp| type| source ---|---|--- 2023-12-24 15:26:08+00:00| seen| https://t.me/ctinow/159029...

cn.eova:eova (>=1.6-beta2, <=1.6-beta3), cn.liangyuen:jfinal-slf4j (1.0) +7 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (3.2)

com.jfinal:jfinal MAVEN version 3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta2, =1.0, =1.3, =2.0.0, =1.0.0.v20180413-release, =1.0.0.v20180413-release, =2.0.0.v20170824-release,...

com.jfinal:jfinal-weixin (2.9), com.jiubanqingchen:wish (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.05)

com.jfinal:jfinal MAVEN version 4.9.05 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-weixin 2.9 - com.jiubanqingchen:wish =0.0.1, =3.6.9, =2.0.4, =2.0.5 Source cves: CVE-2023-49396 Source...

io.jboot:jboot (>=3.9.2, <=3.9.5) potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.07)

com.jfinal:jfinal MAVEN version 4.9.07 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - io.jboot:jboot =3.9.2, =3.9.5 Source cves: CVE-2023-49396 Source advisory: OSV:GHSA-882G-GJQP-9VJP...

com.jfinal:jfinal-undertow (2.5), com.jfinal:jfinal-weixin (>=3.0, <=3.1) +2 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.08)

com.jfinal:jfinal MAVEN version 4.9.08 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.5 - com.jfinal:jfinal-weixin =3.0, =3.9.6, =2.0.6, =2.1.0 Source cves: CVE-2023-49396 Source...

cc.jweb:jweb-adai (>=1.0.2, <=1.0.6), cc.jweb:jweb-boot (>=1.0.2, <=1.0.5) +1 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.09)

com.jfinal:jfinal MAVEN version 4.9.09 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.jweb:jweb-adai =1.0.2, =1.0.2, =3.9.9, =3.9.10 Source cves: CVE-2023-49396 Source advisory: OSV:GHSA-882G-GJQP-9VJP...

io.jboot:jboot (>=2.2.3, <=2.2.4) potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.6)

com.jfinal:jfinal MAVEN version 4.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - io.jboot:jboot =2.2.3, =2.2.4 Source cves: CVE-2023-49396 Source advisory: OSV:GHSA-882G-GJQP-9VJP...

com.jfinal:jfinal-undertow (2.0), com.jfinal:jfinal-weixin (2.5) +5 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.8)

com.jfinal:jfinal MAVEN version 4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.0 - com.jfinal:jfinal-weixin 2.5 - io.jboot:jboot =2.3.1, =3.1.0, =3.5.8.v20191228-release, =0.0.1...

com.github.fangjinuo.sqlhelper:sqlhelper-jfinal (>=1.2.0, <=1.2.3), com.github.xiaoymin:knife4j-jfinal (>=2.0.4, <=3.0.3) +3 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.2)

com.jfinal:jfinal MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.fangjinuo.sqlhelper:sqlhelper-jfinal =1.2.0, =2.0.4, =3.0.3, =2.1.1, =3.3.3.v20190620-release,...

cc.ecore:spring-jfinal (0.0.1), cn.codeforfun:jfinal-activemq (0.3) +24 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (2.2)

com.jfinal:jfinal MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal 0.0.1 - cn.codeforfun:jfinal-activemq 0.3 - cn.codeforfun:jfinal-quartz 0.1 - cn.eova:eova =1.5.0, =2.2,...

cn.zcltd.btg:btg-httpsession (>=4.0.2, <=4.0.11), com.github.gaols:jfinal-springtx-plugin (2.0.2) +6 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (3.6)

com.jfinal:jfinal MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.zcltd.btg:btg-httpsession =4.0.2, =2.2, =2.0-rc.6, =1.3.3, =1.3.5 Source cves: CVE-2023-49396 Source advisory:...

com.jfinal:jfinal-undertow (3.0), com.lastb7:jfinal-swagger-knife4j (>=2.10.1, <=3.0.0) +2 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (5.0.0)

com.jfinal:jfinal MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 3.0 - com.lastb7:jfinal-swagger-knife4j =2.10.1, =1.0.4, =3.15.1, =3.15.5 Source cves:...

cn.dev33:sa-token-jboot-plugin (>=1.30.0.rc, <=1.31.2.temp), com.jfinal:jfinal-undertow (2.9) +2 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.22)

com.jfinal:jfinal MAVEN version 4.9.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.dev33:sa-token-jboot-plugin =1.30.0.rc, =1.0.1, =3.14.4, =3.14.6 Source cves: CVE-2023-49396 Source advisory:...

cn.51daxia:zzz-websocket (>=1.0, <=1.1), com.github.grtechtv:enjoy-mapper (1.0.0) +17 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (3.8)

com.jfinal:jfinal MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.51daxia:zzz-websocket =1.0, =1.1 - com.github.grtechtv:enjoy-mapper 1.0.0 -...

org.casbin:jcasbin-jfinal-plugin (>=1.0.0, <=1.1.0) potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.11)

com.jfinal:jfinal MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - org.casbin:jcasbin-jfinal-plugin =1.0.0, =1.1.0 Source cves: CVE-2023-49396 Source advisory: OSV:GHSA-882G-GJQP-9VJP...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +2 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (1.4)

com.jfinal:jfinal MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =1.0.10, =1.0.11 - com.jfinal:jfinal-ext 3.0.1 Source cves: CVE-2023-49396 Source...

io.jboot:jboot (>=3.14.7, <=3.15.0) potentially affected by CVE-2023-49396 via com.jfinal:jfinal (4.9.23)

com.jfinal:jfinal MAVEN version 4.9.23 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - io.jboot:jboot =3.14.7, =3.15.0 Source cves: CVE-2023-49396 Source advisory: OSV:GHSA-882G-GJQP-9VJP...

cn.eova:eova (>=1.6-beta6, <=1.6.0), cn.zcltd.btg:btg-autoroute-jfinal (3.0.4) +12 more potentially affected by CVE-2023-49396 via com.jfinal:jfinal (3.4)

com.jfinal:jfinal MAVEN version 3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta6, =0.0.2, =3.0.1, =1.3.0, =1.0.0, =2.3.0.v20180506-release, =2.3.0.v20180506-release,...