Deserialization in Pac4j
CVE-2023-25581
pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` c…
Vulnerability class: Insecure Deserialization
EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.
Affected products
- Pac4j — versions < 4.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-25581?
- CVE-2023-25581 is a vulnerability in Pac4j, classified under Deserialization of Untrusted Data. Published 2024-10-10.
- Is CVE-2023-25581 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.