GitHub Advisoryadvisory · Maven

GHSA-cj8w-v588-p8wx pf4j vulnerable to remote code execution via expandIfZip method in the extract function

HIGH Published 2023-08-29 Modified 2023-08-31 Official page ↗
Aliases
CVE-2023-40828
Ecosystem
Maven
Packages
org.pf4j:pf4j
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-94
Reviewed
2023-08-29

Affected packages

• Maven org.pf4j:pf4j: <= 3.9.0 (no fix yet)

Description

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.

Related

Alias · CVE (1)

  • CVE-2023-40828 An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-94 Improper Control of Generation of Code weakness

References