
We found results for “”
MSC-2024-14623
Date: October 8, 2024
This packages holds a malicious code that opens a remote reverse shell anytime there is a stream operation. The malicious code is inside the XZOutputStream class. The code was uploaded by a security firm for POC purposes. If you use this package we strongly recommend replacing it with the original one from: org.tukaani:xz.
Language: Java
Severity Score
Severity Score
Weakness Type (CWE)
Embedded Malicious Code
CWE-506CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | HIGH |
Integrity (I): | HIGH |
Availability (A): | HIGH |