CVE-2023-39022

https://notcve.org/view.php?id=CVE-2023-39022

28 Jul 2023 — oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument. Se ha descubierto que Oscore v2.2.6 e inferiores contienen una vulnerabilidad de inyección de código en el componente "com.opensymphony.util.EJBUtils.createStateless". Esta vulnerabilidad se aprovecha pasando un argumento no comprobado. • https://github.com/LetianYuan/My-CVE-Public-References/tree/main/opensymphony_oscore • CWE-94: Improper Control of Generation of Code ('Code Injection') •