CVE-2023-44794

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-44794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-44794
Aliases
Published
2023-10-25T18:17:32.863Z
Modified
2025-11-20T12:21:09.052056Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.

References

Affected packages

Git / github.com/dromara/sa-token

Affected ranges

Type
GIT
Repo
https://github.com/dromara/sa-token
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e076c716484935939d4a833673d60b82fed33228

Affected versions

v1.*

v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.16.0
v1.17.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.4.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44794.json"

vanir_signatures

[
    {
        "deprecated": false,
        "id": "CVE-2023-44794-4c3fbfeb",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44093278612146247716731950986418545465",
                "51632399438466754187457243840955450331",
                "222791428188717695528727405128599965485",
                "87837935927612785266300580426893223724"
            ]
        },
        "source": "https://github.com/dromara/sa-token/commit/e076c716484935939d4a833673d60b82fed33228",
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java"
        }
    },
    {
        "deprecated": false,
        "id": "CVE-2023-44794-5f502fb5",
        "digest": {
            "length": 2330.0,
            "function_hash": "54194898702652024056318038312975802882"
        },
        "source": "https://github.com/dromara/sa-token/commit/e076c716484935939d4a833673d60b82fed33228",
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "sa-token-starter/sa-token-jfinal-plugin/src/main/java/cn/dev33/satoken/jfinal/SaTokenActionHandler.java",
            "function": "handle"
        }
    },
    {
        "deprecated": false,
        "id": "CVE-2023-44794-654ef5a8",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "261688065426219084529846666997731047104",
                "191889371582170376927365619945637706060",
                "102867401787537383427775182781191032310",
                "248601340686157905810447554822270566951"
            ]
        },
        "source": "https://github.com/dromara/sa-token/commit/e076c716484935939d4a833673d60b82fed33228",
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/springboot/SaPathMatcherTest.java"
        }
    },
    {
        "deprecated": false,
        "id": "CVE-2023-44794-74040cc1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "310198773169346857703455957363254457653",
                "334567421775798696833162346111944518762",
                "69848427213599181601161931963521897765",
                "110007786009302667297900269341204517428",
                "146208870205396012823999017674125503618",
                "120649798327205289543763877735976303541"
            ]
        },
        "source": "https://github.com/dromara/sa-token/commit/e076c716484935939d4a833673d60b82fed33228",
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "sa-token-starter/sa-token-jfinal-plugin/src/main/java/cn/dev33/satoken/jfinal/SaTokenActionHandler.java"
        }
    },
    {
        "deprecated": false,
        "id": "CVE-2023-44794-b4ad150d",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "184109328557939214502457326862654126153",
                "160702301425987199327478598520972708805",
                "199147113211863155339456049717493862902",
                "186126604171780650357119817545348006564",
                "205016142314417732344551924648384312084",
                "250826307401776941124680060956419010144",
                "271024107355568172646869944101373656462",
                "324147340961899337593381701833300823835",
                "22566399533346029147750559564198621583",
                "235303435441847503393822033291309358065",
                "194101048800172372118985704961239593216",
                "200989881866870850411998013179801268460",
                "273929796958699763357453337481497222240",
                "68896615425255964992785501098911048617",
                "215043338086762673355668590439410377313",
                "204884415567519616799081729002616682361",
                "147103278800895454442358528116862546947",
                "2683876260429144968211553377336296014",
                "112340751242678294561606971836885187980",
                "188605045574409408033623822020781803611",
                "292904148497725519054019930901631707959",
                "18327808586073042721594101212017900924",
                "256023770888121242892574946777597137854",
                "248997847077567911426457359312130196670",
                "329470054461788963987972282559816869605",
                "184276415738567553761764816219337138158",
                "195457295459142605330246727802024747689",
                "299489431775453538375506204374262271909",
                "96883153412425170540061047640443415028",
                "79462211899704610441139760377605958691",
                "249092294812531521621841626040317585826",
                "164497692170618037471489387053898428247",
                "290761919506573110953570047691720207436",
                "287293047982150513088202051719364149910",
                "240540785827156665038854272903224247344",
                "21278602033389730520612712535896281269"
            ]
        },
        "source": "https://github.com/dromara/sa-token/commit/e076c716484935939d4a833673d60b82fed33228",
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/springboot/BasicsTest.java"
        }
    }
]