CVE-2023-40826
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
Versions of pf4j up to 3.9.0 have a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
Risk Assessment
The organization may be exposed to data leaks and remote code execution, potentially leading to serious security incidents.
Recommendation
It is recommended to update pf4j to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in pf4j
See all- CVE-2023-40828High
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
- CVE-2023-40827High
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
Original NVD description (English source)
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.