GitHub Advisoryadvisory · Maven

GHSA-54f6-9mx9-86f7 SaToken privilege escalation vulnerability

CRITICAL Published 2023-10-25 Modified 2024-09-12 Official page ↗

Aliases: CVE-2023-44794
Ecosystem: Maven
Packages: cn.dev33:sa-token-core
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-281, CWE-284
Reviewed: 2023-10-27

Affected packages

• Maven cn.dev33:sa-token-core: < 1.37.0 → fixed in 1.37.0

Description

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.

Related

Alias · CVE (1)

CVE-2023-44794 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. vulnerability

Weakness · CWE (2)

CWE-281 Improper Preservation of Permissions weakness
CWE-284 Improper Access Control weakness

References