PT-2024-37628 · Oripa · Oripa

Aftersnow · Published 2024-07-02 · Updated 2024-07-02 · CVE-2024-6441

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ORIPA versions up to 1.72

Description A critical issue was found in ORIPA, affecting an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation of this issue leads to deserialization and can be launched remotely.

Recommendations For versions up to 1.72, upgrade to version 1.80 to address this issue. It is recommended to upgrade the affected component.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-6441

Affected Products

Oripa

References · 8

• https://github.com/oripa/oripa/pull/356/commits/1abf8eb9b6b173d86d277426db1a551d6490c94a · Patch
• https://github.com/oripa/oripa/milestone/15 · Patch
• https://osv.dev/vulnerability/CVE-2024-6441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6441 · Security Note
• https://github.com/oripa/oripa/issues/355 · Note
• https://vuldb.com/?id.270169 · Note
• https://vuldb.com/?submit.367350 · Note
• https://vuldb.com/?ctiid.270169 · Note