PT-2023-23480 · Skyscreamer · Nevado Jms

Novy · Publicado 2023-05-23 · Atualizado 2025-01-17 · CVE-2023-31826

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Skyscreamer Open Source Nevado JMS version 1.3.2

Description The issue allows attackers to execute arbitrary commands by supplying crafted data due to the lack of security checks when receiving messages.

Recommendations For Skyscreamer Open Source Nevado JMS version 1.3.2, consider implementing security checks for incoming messages to prevent the execution of arbitrary commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-31826

GHSA-7GM3-MWJW-J53W

Produtos afetados

Nevado Jms

Referências · 10

• 🔥 https://novysodope.github.io/2023/04/01/95 · Exploit
• https://github.com/skyscreamer/nevado · Nota
• https://github.com/skyscreamer/nevado/releases · Nota
• https://github.com/skyscreamer/nevado/issues/121 · Nota
• https://t.me/cibsecurity/64599 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31826 · Nota de Segurança
• https://t.me/cvenotify/51406 · Publicação no Telegram
• http://nevado.skyscreamer.org · Nota
• https://osv.dev/vulnerability/CVE-2023-31826 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7gm3-mwjw-j53w · Aviso do Fabricante