CVE-2023-28462 Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed
Remote attackers can execute malicious code on Payara Server via JNDI rebind operations when using older Java versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28462?
CVE-2023-28462 is a critical unsafe deserialization vulnerability in n/a, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.
Weakness: CWE-502
Which versions are affected by CVE-2023-28462?
2 open source packages ship an affected version, including fish.payara.server:payara-aggregator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fish.payara.server:payara-aggregator Maven | From 5.2020.1 | 6.2022.1.Alpha3 |
fish.payara.server:payara-aggregator Maven | From 5.2020.1 | 6.2022.1.Alpha3 |
Products include Payara Payara Server.
How do I fix CVE-2023-28462?
Upgrade fish.payara.server:payara-aggregator to 6.2022.1.Alpha3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-28462 being exploited?
There is no known exploitation of CVE-2023-28462 in the wild and no public exploit code.
Sources
Also known as GHSA-xc93-587g-mxm7.