GHSA-7gm3-mwjw-j53w

Command injection in nevado-jms

Source: GitHub Advisory Database (reviewed) High CVE-2023-31826

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.skyscreamer:nevado-jms	<= 1.3.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-31826 advisory
https://github.com/skyscreamer/nevado/issues/121 web
https://github.com/skyscreamer/nevado package
https://github.com/skyscreamer/nevado/releases web
https://novysodope.github.io/2023/04/01/95 web
http://nevado.skyscreamer.org web