Description

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

Remediation

References

https://github.com/skyscreamer/nevado/issues/121

http://nevado.skyscreamer.org/

https://github.com/skyscreamer/nevado/releases

https://novysodope.github.io/2023/04/01/95/

Related Vulnerabilities

CVE-2020-7641 Vulnerability in npm package grunt-util-property

CVE-2020-28500 Vulnerability in maven package org.webjars.npm:lodash

CVE-2022-45210 Vulnerability in maven package org.jeecgframework.boot:jeecg-module-system

CVE-2023-38687 Vulnerability in npm package svelecte

CVE-2022-1233 Vulnerability in npm package urijs

Severity

High

Classification

CWE-862 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Product Release Notes Exploit Third Party Advisory