CVE-2023-40827
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
Risk Assessment
An attacker could exploit this vulnerability to gain control over the system, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade pf4j to a version newer than 3.9.0 to mitigate this vulnerability.
Other vulnerabilities in pf4j
See all- CVE-2023-40828High
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
- CVE-2023-40826High
Versions of pf4j up to 3.9.0 have a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
Original NVD description (English source)
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.