GHSA-gxg6-rc6c-v673

Source

https://github.com/advisories/GHSA-gxg6-rc6c-v673

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gxg6-rc6c-v673/GHSA-gxg6-rc6c-v673.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gxg6-rc6c-v673

Aliases

CVE-2016-2510

Published

2022-05-13T01:14:25Z

Modified

2023-11-08T03:58:24.404260Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Input Validation in BeanShell

Details

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

Database specific

{
    "nvd_published_at": "2016-04-07T20:59:00Z",
    "github_reviewed_at": "2022-07-06T19:57:52Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Maven / org.apache-extras.beanshell:bsh

Package

Name: org.apache-extras.beanshell:bsh; View open source insights on deps.dev
Purl: pkg:maven/org.apache-extras.beanshell/bsh

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0b6

Affected versions

2.*

2.0b5

Database specific

{
    "last_known_affected_version_range": "<= 2.0b5"
}