GitHub Advisoryadvisory · Maven

GHSA-q74f-rf27-8hxc OpenCRX allows a remote attacker to execute arbitrary code via a crafted request

CRITICAL Published 2023-10-31 Modified 2023-11-06 Official page ↗

Aliases: CVE-2023-46502
Ecosystem: Maven
Packages: org.opencrx:opencrx-client
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-611, CWE-918
Reviewed: 2023-11-01

Affected packages

• Maven org.opencrx:opencrx-client: < 5.3.0 → fixed in 5.3.0

Description

An issue in OpenCRX v.5.2.2 allows a remote attacker to execute arbitrary code via a crafted request.

Related

Alias · CVE (1)

CVE-2023-46502 An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure… vulnerability

Weakness · CWE (2)

CWE-611 Improper Restriction of XML External Entity Reference weakness
CWE-918 Server-Side Request Forgery weakness

References