Skip to content

Commit 161c30d

Browse files
CharlesRNDamoOne
andauthored
Edited to fix Syntax Error (#1042)
* Java deserialization vulnerability * Removed the quotes to fix syntax error. --------- Co-authored-by: DamoOne <[email protected]>
1 parent cd28e4e commit 161c30d

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

docs/advisories/20241015001-Java-deserialization-vulnerability.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22

33
## Overview
44

5-
The WA SOC has been made aware of a vulnerability in Java security framework. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. An attacker can leverage this vulnerability to exploited an attribute that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding.
5+
The WA SOC has been made aware of a vulnerability in Java security framework. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. An attacker can leverage this vulnerability to exploited an attribute that contains a serialized Java object with a special prefix `\{#sb64\}` and Base64 encoding.
66

77
## What is vulnerable?
88

9-
| Product(s) Affected | Version(s) | CVE | CVSS | Severity |
10-
| ------------------- | ---------- | ----------------------------------------------------------------- | ---- | ------------ |
11-
| pac4j-core | \< 4.0.0 | [CVE-2023-25581](https://nvd.nist.gov/vuln/detail/CVE-2023-25581) | 9.2 | **Critical** |
9+
| Product(s) Affected | Version(s) | CVE | CVSS | Severity |
10+
| ------------------------------ | ------------------------------------------------------ | --------------------------------------------------------------- | ---- | ------------ |
11+
|pac4j-core | \< 4.0.0 | [CVE-2023-25581](https://nvd.nist.gov/vuln/detail/CVE-2023-25581) | 9.2 | **Critical** |
1212

1313
## What has been observed?
1414

0 commit comments

Comments
 (0)