Description

Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.

Remediation

References

https://github.com/larsga/Duke/issues/273

Related Vulnerabilities

CVE-2023-41037 Vulnerability in npm package openpgp

CVE-2023-45135 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

CVE-2022-25858 Vulnerability in maven package org.webjars.npm:terser

CVE-2021-36686 Vulnerability in npm package yapi-vendor

CVE-2023-29526 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-macro

Severity

Critical

Classification

CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking