GitHub Advisoryadvisory · Maven
GHSA-p6m6-9j36-vfjx glazedlists XML Deserialization vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2023-31890
- Ecosystem
- Maven
- Packages
- com.glazedlists:glazedlists
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2023-05-17
Affected packages
• Maven com.glazedlists:glazedlists: 1.11.0 (no fix yet)
Description
An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.
Related
Alias · CVE (1)
- CVE-2023-31890 An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode()… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-31890 advisory
- https://github.com/glazedlists/glazedlists/issues/709 web
- https://github.com/glazedlists/glazedlists package
- https://github.com/glazedlists/glazedlists/blob/e0593e338246945dab4e83356ef44a59db172a80/extensions/io/src/main/java/ca/odell/glazedlists/impl/io/BeanXMLByteCoder.java web