Untitled

🗓️ 18 Oct 2024 08:21:25Reported by Veracode Vulnerability DatabaseType

Vulnerability in pac4j-core allows arbitrary code execution via crafted serialized Java objects.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2023-25581	15 Oct 202423:51	–	githubexploit
Circl	CVE-2023-25581	10 Oct 202419:16	–	circl
CNNVD	pac4j 代码问题漏洞	10 Oct 202400:00	–	cnnvd
CVE	CVE-2023-25581	10 Oct 202415:49	–	cve
Cvelist	CVE-2023-25581 Deserialization of untrusted data in InternalAttributeHandler in pac4j	10 Oct 202415:49	–	cvelist
EUVD	EUVD-2024-2974	10 Oct 202415:49	–	euvd
F5 Networks	K000148598: pac4j vulnerability CVE-2023-25581	18 Nov 202417:39	–	f5
Github Security Blog	pac4j-core affected by a Java deserialization vulnerability	11 Oct 202422:16	–	github
NVD	CVE-2023-25581	10 Oct 202416:15	–	nvd
OSV	CVE-2023-25581 Deserialization of untrusted data in InternalAttributeHandler in pac4j	10 Oct 202415:49	–	osv

Vulners

Node

pac4j-core pac4j-coreRange1.4.0–3.9.0java

Source	Link
securitylab	www.securitylab.github.com/advisories
github	www.github.com/gradio-app/gradio/commit/6f95286337459efbccb95c9cfac63355669df9ee
github	www.github.com/frohoff/ysoserial
securitylab	www.securitylab.github.com/advisories/GHSL-2022-085_pac4j
portswigger	www.portswigger.net/web-security/deserialization
github	www.github.com/advisories/GHSA-76mw-6p95-x9x5
securitylab	www.securitylab.github.com/advisories/GHSL-2022-085_pac4j/
github	www.github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java

18 Oct 2024 12:14Current

7.2High risk

Vulners AI Score7.2

CVSS 49.2

EPSS0.19032

SSVC