CVE-2023-40571

    Dashboard / Vulnerabilities / CVE-2023-40571

    CVE-2023-40571

    Published: 25 Aug 2023Last Modified: 29 Nov 2023

    Summary:

    Details: weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.

    References: https://github.com/dream0x01/weblogic-framework/security/advisories/GHSA-hjwj-4f3q-44h3, https://github.com/dream0x01/weblogic-framework/releases/tag/v0.2.4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a33e7ee8ce05edd7b9f8e4b740bbf43b3a866e3c

    Affected versions

    v0.2.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40571 | CVE-DB