Detections
Analytics

SCA: security update for org.pac4j:pac4j-core (GHSA-76mw-6p95-x9x5)

critical Tenable Cloud Security Plugin ID 411869

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java
 deserialization vulnerability. The vulnerability affects systems that store externally controlled values
 in attributes of the `UserProfile` class from pac4j-core. It can be exploited by providing an attribute
 that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding. This issue may
 lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in
 place, that puts some restriction on what classes can be deserialized, it still allows a broad range of
 java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater
 are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this
 vulnerability. (CVE-2023-25581)

See Also

https://github.com/advisories/GHSA-76mw-6p95-x9x5

Plugin Details

Severity: Critical

ID: 411869

Version: Revision 1.17

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.5

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-25581

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/11/2024

Vulnerability Publication Date: 10/10/2024

Reference Information

CVE: CVE-2023-25581

cwe: CWE-502