First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-39023

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/LetianYuan/My-CVE-Public-References/tree/main/org_compass-project_compassExploit, Third Party Advisory
https://github.com/LetianYuan/My-CVE-Public-References/tree/main/org_compass-project_compassExploit, Third Party Advisory

Timeline

Published: Jul 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-390267.5Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive i CVE-2023-390396.5An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39047.5An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all CVE-2023-390406.5An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390416.5An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390427.5An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390436.5An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390446.5An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390456.5An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390466.5An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390477.5An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-390487.5An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.