PT-2023-31756 · Mvel2 · Mvel2

Poppingsnack · Publicado 2023-12-27 · Atualizado 2024-08-02 · CVE-2023-51079

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions mvel2 version 2.5.0 Final

Description A TimeOut error exists in the ParseTools.subCompileExpression method due to many Java class lookups, potentially causing a long execution time. The vendor disputes the significance of this issue, stating that the only expected consequence is a significant delay in the parser completing its task.

Recommendations For mvel2 version 2.5.0 Final, consider applying optimization techniques to reduce the number of Java class lookups in the ParseTools.subCompileExpression method to mitigate the risk of a TimeOut error. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2023-51079

GHSA-H63J-XQX6-W58R

Produtos afetados

Mvel2

Referências · 14

• 🔥 https://github.com/mvel/mvel/issues/348 · Exploit
• https://github.com/mvel/mvel/issues/348#issuecomment-1874047271 · Nota
• https://github.com/mvel/mvel · Nota
• https://ubuntu.com/security/CVE-2023-51079 · Aviso do Fabricante
• https://t.me/cvenotify/66948 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1740118917866270952 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-51079 · Aviso do Fabricante
• https://t.me/cvenotify/66599 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-h63j-xqx6-w58r · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-51079 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-51079 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-51079 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1740154850573267168 · Publicação no Twitter
• https://t.me/cvenotify/88671 · Publicação no Telegram