CVE-2023-33496 Security Details

CVE ID

CVE-2023-33496

CWE

CWE-502

CVE Description

xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode.

Published

Jun 13, 2023

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.396%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/xxl/rpc/core/remoting/net/impl/netty/codec/NettyDecoder.decode(Lio/netty/channel/ChannelHandlerContext;Lio/netty/buffer/ByteBuf;Ljava/util/List;)V

JVMVulnerable params: 1

com/xxl/rpc/remoting/net/impl/netty/codec/NettyDecoder.decode(Lio/netty/channel/ChannelHandlerContext;Lio/netty/buffer/ByteBuf;Ljava/util/List;)V

JVMVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-c29g-q3h3-mwcfTHIRD_PARTY