CVE-2023-39017

CriticalCVSS 9.8

Published: 28/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.02%

59th percentile - higher than 59% of all known CVEs

Summary

Versions quartz-jobs 2.3.2 and below contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited by passing an unchecked argument.

Risk Assessment

This vulnerability could lead to unauthorized code execution; however, there are disputes regarding the plausibility of untrusted user input reaching the injection point.

Recommendation

It is recommended to upgrade to a newer version of quartz-jobs to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.