Description

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

Remediation

References

http://nevado.skyscreamer.org/

https://github.com/skyscreamer/nevado/issues/121

https://github.com/skyscreamer/nevado/releases

https://novysodope.github.io/2023/04/01/95/

Related Vulnerabilities

CVE-2023-49068 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-api

CVE-2019-20444 Vulnerability in maven package io.netty:netty-all

CVE-2022-31160 Vulnerability in maven package org.fujion.webjars:jquery-ui

CVE-2023-26471 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-macro

CVE-2021-27515 Vulnerability in maven package org.webjars.npm:url-parse

Severity

High

Classification

CWE-862 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Product Issue Tracking Release Notes Exploit Third Party Advisory