CVE-2023-40828
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
Risk Assessment
An attacker could exploit this vulnerability to gain control over the system, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update pf4j to a version newer than 3.9.0 to mitigate this vulnerability.
Other vulnerabilities in pf4j
See all- CVE-2023-40827High
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
- CVE-2023-40826High
Versions of pf4j up to 3.9.0 have a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
Original NVD description (English source)
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.