What is GHSA-rx62-5cw6-x29q?

GHSA-rx62-5cw6-x29q is a security advisory published by GitHub Security Advisories with Medium severity. Whaleal IceFrog is vulnerable to deserialization

Which CVE IDs does GHSA-rx62-5cw6-x29q cover?

GHSA-rx62-5cw6-x29q covers the following CVE IDs: CVE-2023-3308. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rx62-5cw6-x29q?

GHSA-rx62-5cw6-x29q has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-rx62-5cw6-x29q?

GHSA-rx62-5cw6-x29q affects 1 product, including: maven/com.whaleal.icefrog:icefrog-all:\u003c= 1.1.8.

GHSA-rx62-5cw6-x29qMediumCVSS 5.5

Whaleal IceFrog is vulnerable to deserialization

Vendor

GitHub Security Advisories

Published

June 18, 2023

Last Modified

March 1, 2024

🔗 CVE IDs covered (1)

CVE-2023-3308 →

📋 Description

Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

🎯 Affected products1

maven/com.whaleal.icefrog:icefrog-all:<= 1.1.8

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2023-3308
https://vuldb.com/?ctiid.231804
https://vuldb.com/?id.231804
https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal:icefrog/icefrog_1.1.8_RCE.md
https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal%3Aicefrog/icefrog_1.1.8_RCE.md
https://github.com/advisories/GHSA-rx62-5cw6-x29q