CVE-2023-4528

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Redwood Software	JSCAPE MFT Server	< 2023.1.9

References

https://www.jscape.com/blog/binary-management-service-patch-cve-2023-4528Vendor Advisory
https://www.rapid7.com/blog/post/2023/09/07/cve-2023-4528-java-deserialization-vulnerability-in-jscape-mft-fixed/Mitigation, Third Party Advisory
https://www.jscape.com/blog/binary-management-service-patch-cve-2023-4528Vendor Advisory
https://www.rapid7.com/blog/post/2023/09/07/cve-2023-4528-java-deserialization-vulnerability-in-jscape-mft-fixed/Mitigation, Third Party Advisory

Timeline

Published: Sep 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-452805.4Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. Th CVE-2023-452816.1An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.CVE-2023-452827.5In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.CVE-2023-452837.5The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device p CVE-2023-452845.3On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "CVE-2023-452857.5Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailab CVE-2023-452865.9A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Poo CVE-2023-452877.5Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent t CVE-2023-452887.5An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Mai CVE-2023-452894.3When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not for CVE-2023-452906.5When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue CVE-2023-452925.3When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a n