Junglewise Threat Intelligence

CVE-2023-40828: pf4j vulnerable to remote code execution via expandIfZip method in the extract function

CVE-2023-40828 · Severity: low · CVSS 3.1 · Published 2023-08-29

Technologies: org.pf4j:pf4j (Maven). Vendors: Maven.

Executive brief

pf4j vulnerable to remote code execution via expandIfZip method in the extract function

Affected products

Maven org.pf4j:pf4j

Related threats

pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names
pf4j vulnerable to remote code execution via loadpluginPath parameter
pf4j vulnerable to remote code execution via the zippluginPath parameter