GHSA-rx62-5cw6-x29q

Whaleal IceFrog is vulnerable to deserialization

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-3308

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.whaleal.icefrog:icefrog-all	<= 1.1.8	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-3308 advisory
https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal%3Aicefrog/icefrog_1.1.8_RCE.md web
https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal:icefrog/icefrog_1.1.8_RCE.md web
https://github.com/whaleal/icefrog package
https://vuldb.com/?ctiid.231804 web
https://vuldb.com/?id.231804 web