PT-2023-31756 · Mvel2 · Mvel2

Poppingsnack · Published 2023-12-27 · Updated 2024-08-02 · CVE-2023-51079

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions mvel2 version 2.5.0 Final

Description A TimeOut error exists in the ParseTools.subCompileExpression method due to many Java class lookups, potentially causing a long execution time. The vendor disputes the significance of this issue, stating that the only expected consequence is a significant delay in the parser completing its task.

Recommendations For mvel2 version 2.5.0 Final, consider applying optimization techniques to reduce the number of Java class lookups in the ParseTools.subCompileExpression method to mitigate the risk of a TimeOut error. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-51079

GHSA-H63J-XQX6-W58R

Affected Products

Mvel2

References · 14

• 🔥 https://github.com/mvel/mvel/issues/348 · Exploit
• https://ubuntu.com/security/CVE-2023-51079 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-51079 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h63j-xqx6-w58r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51079 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-51079 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51079 · Vendor Advisory
• https://github.com/mvel/mvel/issues/348#issuecomment-1874047271 · Note
• https://github.com/mvel/mvel · Note
• https://t.me/cvenotify/66948 · Telegram Post
• https://twitter.com/CVEnew/status/1740118917866270952 · Twitter Post
• https://t.me/cvenotify/66599 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1740154850573267168 · Twitter Post
• https://t.me/cvenotify/88671 · Telegram Post