Description

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

Remediation

References

https://github.com/skyscreamer/nevado/issues/121

http://nevado.skyscreamer.org/

https://github.com/skyscreamer/nevado/releases

https://novysodope.github.io/2023/04/01/95/

Related Vulnerabilities

CVE-2021-39157 Vulnerability in npm package detect-character-encoding

CVE-2022-45396 Vulnerability in maven package com.thalesgroup.hudson.plugins:sourcemonitor

CVE-2020-9488 Vulnerability in maven package org.apache.logging.log4j:log4j

CVE-2023-28155 Vulnerability in npm package request

CVE-2021-28128 Vulnerability in npm package strapi

Severity

High

Classification

CWE-862 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Product Release Notes Exploit Third Party Advisory