whaleal/icefrog · Security
Whaleal IceFrog is vulnerable to deserialization
- GHSA ID
- GHSA-rx62-5cw6-x29q
- CVE ID
- CVE-2023-3308
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 5.5 · CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3308 ↗
- https://vuldb.com/?ctiid.231804 ↗
- https://vuldb.com/?id.231804 ↗
- https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal:icefrog/icefrog_1.1.8_RCE.md ↗
- https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal%3Aicefrog/icefrog_1.1.8_RCE.md ↗
- https://github.com/advisories/GHSA-rx62-5cw6-x29q ↗