GitHub Advisoryadvisory · Maven
GHSA-rx62-5cw6-x29q Whaleal IceFrog is vulnerable to deserialization
MEDIUM
Official page ↗
- Aliases
- CVE-2023-3308
- Ecosystem
- Maven
- Packages
- com.whaleal.icefrog:icefrog-all
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-502
- Reviewed
- 2023-06-19
Affected packages
• Maven com.whaleal.icefrog:icefrog-all: <= 1.1.8 (no fix yet)
Description
Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Related
Alias · CVE (1)
- CVE-2023-3308 A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3308 advisory
- https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal%3Aicefrog/icefrog_1.1.8_RCE.md web
- https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal:icefrog/icefrog_1.1.8_RCE.md web
- https://github.com/whaleal/icefrog package
- https://vuldb.com/?ctiid.231804 web
- https://vuldb.com/?id.231804 web