CVE-2023-25581
1 advisory.
Maven/org.pac4j:pac4j-core CVE-2023-25581: critical 9.8
pac4j-core affected by a Java deserialization vulnerability
Action: Upgrade org.pac4j:pac4j-core to 4.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.0 | - |
Fixed versions
| 4.0.0 |
Sources
- osv: GHSA-76mw-6p95-x9x5
- https://nvd.nist.gov/vuln/detail/CVE-2023-25581
- https://github.com/frohoff/ysoserial
- https://github.com/pac4j/pac4j
- https://github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java#L95
- https://portswigger.net/web-security/deserialization
- https://securitylab.github.com/advisories
- https://securitylab.github.com/advisories/GHSL-2022-085_pac4j
CVE-2023-25581 · published · modified · JSON