CVE-2023-39016

CriticalCVSS 9.8

Published: 28/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

Versions bboss-persistent v6.0.9 and below were found to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited by passing an unchecked argument.

Risk Assessment

The organization may be exposed to attacks that allow unauthorized access to the database or execution of malicious code. This could lead to data loss or compromise of system integrity.

Recommendation

It is recommended to upgrade to the latest version of bboss-persistent to eliminate this vulnerability. Additionally, implement further validation checks on arguments passed to the component.

Original NVD description (English source)

bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited via passing an unchecked argument.