~ / search / GHSA-77h8-5j3h-jcjf

GHSA-77h8-5j3h-jcjf

Dromara Hutool Deserialization of Untrusted Data vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-24162

Packages

EcosystemPackageAffectedFixed in
Maven cn.hutool:hutool-all <= 5.8.11 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

References

External links from the advisory. They lead to third-party sites.