Lucene search

GoogleOSV:CVE-2024-23682

HistoryJan 19, 2024 - 9:15 p.m.

CVE-2024-23682

2024-01-1921:15:10

Google

osv.dev

artemis java

test sandbox

vulnerability

sandbox escape

attacker

class files

package

ares

trust

arbitrary java

execution

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.

References

github.com/advisories/GHSA-227w-wv4j-67h4

github.com/ls1intum/Ares/issues/15

github.com/ls1intum/Ares/releases/tag/1.8.0

github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4

vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for OSV:CVE-2024-23682