CVE-2024-23682
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in Artemis Java Test Sandbox before version 1.8.0 allows a sandbox escape by including trusted class files. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
Risk Assessment
The risk involves remote code execution in the victim's context, potentially leading to system compromise or data theft.
Recommendation
Immediately update Artemis Java Test Sandbox to version 1.8.0 or later, which fixes this vulnerability.
Other vulnerabilities in Artemis Java Test Sandbox
See all- CVE-2024-23683High
A vulnerability in Artemis Java Test Sandbox versions prior to 1.7.6 allows a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can exploit this issue to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
- CVE-2024-23681High
A vulnerability in Artemis Java Test Sandbox before version 1.11.2 allows a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.
Original NVD description (English source)
Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.