CVE-2023-39017

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/quartz-scheduler/quartz/issues/943Exploit, Issue Tracking
https://github.com/quartz-scheduler/quartz/issues/943Exploit, Issue Tracking

Timeline

Published: Jul 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-390189.8FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This CVE-2023-390209.8stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2Piped CVE-2023-390219.8wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Set CVE-2023-390229.8oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createState CVE-2023-390239.8university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.Defa CVE-2023-390267.5Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive i CVE-2023-390396.5An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39047.5An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all CVE-2023-390406.5An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390416.5An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390427.5An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390436.5An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.