CVE-2024-23681
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in Artemis Java Test Sandbox before version 1.11.2 allows a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
Risk Assessment
The organization is at risk of remote arbitrary Java code execution, which could lead to system compromise, data theft, or privilege escalation.
Recommendation
Immediately upgrade Artemis Java Test Sandbox to version 1.11.2 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Artemis Java Test Sandbox
See all- CVE-2024-23683High
A vulnerability in Artemis Java Test Sandbox versions prior to 1.7.6 allows a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can exploit this issue to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
- CVE-2024-23682High
A vulnerability in Artemis Java Test Sandbox before version 1.8.0 allows a sandbox escape by including trusted class files. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
Original NVD description (English source)
Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.