Lucene search

GoogleOSV:CVE-2024-23683

HistoryJan 19, 2024 - 9:15 p.m.

CVE-2024-23683

2024-01-1921:15:10

Google

osv.dev

artemis

java

sandbox escape

vulnerability

invocationtargetexception

arbitrary execution

software vulnerability

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.

References

github.com/advisories/GHSA-883x-6fch-6wjx

github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415352a0a3217392

github.com/ls1intum/Ares/issues/15#issuecomment-996449371

github.com/ls1intum/Ares/releases/tag/1.7.6

github.com/ls1intum/Ares/security/advisories/GHSA-883x-6fch-6wjx

vulncheck.com/advisories/vc-advisory-GHSA-883x-6fch-6wjx

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for OSV:CVE-2024-23683