Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03Z20zLW13anctajUzd84AAzbz

Command injection in nevado-jms

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

Permalink: https://github.com/advisories/GHSA-7gm3-mwjw-j53w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Z20zLW13anctajUzd84AAzbz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00045
EPSS Percentile: 0.17516

Identifiers: GHSA-7gm3-mwjw-j53w, CVE-2023-31826
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-31826
• https://github.com/skyscreamer/nevado/issues/121
• https://github.com/skyscreamer/nevado/releases
• https://novysodope.github.io/2023/04/01/95/
• http://nevado.skyscreamer.org/
• https://github.com/advisories/GHSA-7gm3-mwjw-j53w

Repository: https://github.com/skyscreamer/nevado
Blast Radius: 4.7

Affected Packages