CVE-2023-39022

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-390239.8university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaCVE-2023-390267.5Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive iCVE-2023-390396.5An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39047.5An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all CVE-2023-390406.5An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390416.5An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390427.5An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390436.5An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390446.5An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390456.5An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390466.5An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390477.5An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.