Description

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

Remediation

References

http://nevado.skyscreamer.org/

https://github.com/skyscreamer/nevado/issues/121

https://github.com/skyscreamer/nevado/releases

https://novysodope.github.io/2023/04/01/95/

Related Vulnerabilities

CVE-2020-1695 Vulnerability in maven package org.jboss.resteasy:resteasy-core

CVE-2019-12041 Vulnerability in maven package org.webjars.bowergithub.jonschlinkert:remarkable

CVE-2019-20365 Vulnerability in maven package org.igniterealtime.openfire:xmppserver

CVE-2022-25876 Vulnerability in npm package link-preview-js

CVE-2021-3810 Vulnerability in npm package code-server

Severity

High

Classification

CWE-862 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Product Issue Tracking Release Notes Exploit Third Party Advisory