CVE-2023-48967 Solon is vulnerable to Deserialization of Untrusted Data

Q: Which versions are affected by CVE-2023-48967?

2 open source packages ship an affected version, including org.noear:solon. It affects 1 product.

Q: Is CVE-2023-48967 being exploited?

There is no known exploitation of CVE-2023-48967 in the wild and no public exploit code.

Q: How do I fix CVE-2023-48967?

No fix has been published for CVE-2023-48967 yet. Limit exposure of the affected software until one is available.

Critical 9.8 Published 4 Dec 2023 Updated 2 Aug 2024

Attackers can execute arbitrary code by exploiting unsafe deserialization in the Ssolon Java framework.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-48967?

CVE-2023-48967 is a critical unsafe deserialization vulnerability in n/a, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.

Weakness: CWE-502

Which versions are affected by CVE-2023-48967?

2 open source packages ship an affected version, including org.noear:solon. It affects 1 product.

Package	Affected	Fixed in
`org.noear:solon` Maven	All versions to `2.6.0`	None
`org.noear:solon` Maven	All versions to `2.6.0`	None

Products include Noear Solon.

How do I fix CVE-2023-48967?

No fix has been published for CVE-2023-48967 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-48967 being exploited?

There is no known exploitation of CVE-2023-48967 in the wild and no public exploit code.

CVE-2025-46096 Solon Vulnerable to Directory Traversal Medium 6.1

Sources

Also known as GHSA-vwgg-2q82-38c5.