CVE-2023-24621: High severity Esotericsoftware Yamlbeans vulnerability
Published Aug 25, 2023
·Updated
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.
Affected Software
2 affected components
maven/com.esotericsoftware.yamlbeans:yamlbeans<=1.15
Esotericsoftware Yamlbeans<=1.15
Event History
Aug 25, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
09:30 PM
Data Sourced
via GitHub·09:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-24621?
CVE-2023-24621 has a high severity due to the risk of untrusted deserialization of Java classes.
2
How do I fix CVE-2023-24621?
To fix CVE-2023-24621, upgrade to a version of YamlBeans higher than 1.15 where this vulnerability is addressed.
3
What types of applications are affected by CVE-2023-24621?
CVE-2023-24621 affects applications using YamlBeans version 1.15 or lower for YAML data processing.
4
Can CVE-2023-24621 lead to remote code execution?
Yes, CVE-2023-24621 can potentially allow remote code execution due to untrusted deserialization.
5
Who is responsible for the CVE-2023-24621 vulnerability?
The CVE-2023-24621 vulnerability is attributed to YamlBeans, developed by Esoteric Software.