CVE-2023-39022

CriticalCVSS 9.8

Published: 28/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.99%

58th percentile - higher than 58% of all known CVEs

Summary

Versions oscore v2.2.6 and below were found to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability can be exploited by passing an unchecked argument.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized code execution, posing a serious threat to the security of the application and the organization's data.

Recommendation

It is recommended to upgrade to the latest version of oscore to eliminate this vulnerability and implement argument validation mechanisms.

Original NVD description (English source)

oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.