CVE-2023-38647
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-38647 is a critical vulnerability that affects all versions lower than and including 1.2.0 of the helix-core and helix-rest products. This vulnerability allows an attacker to exploit the SnakeYAML library to deserialize java.net.URLClassLoader, loading a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load malicious code using that ClassLoader. This unbounded deserialization can potentially lead to remote code execution. To mitigate this vulnerability in the short term, it is recommended to stop using YAML-based configuration and workflow creation. In the long term, upgrading all Helix versions to 1.3.0 or higher is advised. The National Vulnerability Database (NVD) gives this vulnerability a base severity rating of CRITICAL with a CVSS score of 9.8 out of 10, highlighting its significant impact on confidentiality, integrity, and availability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions