CVE-2023-25581

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-25581
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25581.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25581
Aliases
Published
2024-10-10T15:49:28.316Z
Modified
2026-04-10T04:56:03.877379Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Deserialization of untrusted data in InternalAttributeHandler in pac4j
Details

pac4j is a security framework for Java. pac4j-core prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the UserProfile class from pac4j-core. It can be exploited by providing an attribute that contains a serialized Java object with a special prefix {#sb64} and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a RestrictedObjectInputStream is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25581.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pac4j/pac4j

Affected ranges

Type
GIT
Repo
https://github.com/pac4j/pac4j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
332a4f2d38015495108b225a3f7353a165969f90
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.0.0"
        }
    ]
}

Affected versions

pac4j-1.*
pac4j-1.4.0
pac4j-1.4.1
pac4j-1.5.0
pac4j-1.5.1
pac4j-1.6.0
pac4j-1.6.0-RC1
pac4j-1.7.0
pac4j-1.8.0
pac4j-1.8.0-RC1
pac4j-1.8.1
pac4j-1.8.2
pac4j-1.8.3
pac4j-1.9.0
pac4j-1.9.1
pac4j-1.9.2
pac4j-1.9.3
pac4j-2.*
pac4j-2.0.0
pac4j-2.0.0-RC1
pac4j-2.0.0-RC2
pac4j-2.1.0
pac4j-3.*
pac4j-3.0.0
pac4j-3.0.0-RC1
pac4j-3.0.0-RC2
pac4j-3.0.1
pac4j-3.1.0
pac4j-3.2.0
pac4j-3.3.0
pac4j-3.4.0
pac4j-4.*
pac4j-4.0.0-RC1
pac4j-4.0.0-RC2
pac4j-4.0.0-RC3
scribe-up-1.*
scribe-up-1.0.0
scribe-up-1.1.0
scribe-up-1.3.0
scribe-up-1.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25581.json"