Remote Code Execution Vulnerability in Symphony by 88250
CVE-2024-23049

9.8CRITICAL

Key Information:

Vendor

B3log

Status
Symphony
Vendor
CVE Published:
5 February 2024

What is CVE-2024-23049?

A remote code execution vulnerability has been identified in Symphony versions up to and including 3.6.3, where a flaw in the log4j component allows attackers to execute arbitrary code. This vulnerability poses significant risks, enabling unauthorized remote code execution that could compromise system integrity and data security. Users of affected versions are advised to apply updates promptly and review security configurations to mitigate potential threats.

References

https://github.com/88250/symphony/issues/82

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.