CVE-2021-40146: falha em Apache Any23
A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 5.7%
A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.
Produtos afetados
Apache Software Foundation · Apache Any23CVEs relacionadas — Apache Any23
No mesmo produto, das mais perigosas para as menos.
CVE-2022-25312—An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractorEPSS 2.9%CVE-2021-38555—An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.javaEPSS 2.8%CVE-2023-34150MEDIUMApache Any23: Possible excessive allocation of resources reading input.EPSS 1.5%