CVE-2023-39022

Name of the Vulnerable Software and Affected Versions oscore versions 2.2.6 and below

Description The issue is related to a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless(). This vulnerability can be exploited by passing an unchecked argument to the affected component.

Recommendations For oscore versions 2.2.6 and below, consider restricting access to the com.opensymphony.util.EJBUtils.createStateless() function until a patch is available. As a temporary workaround, ensure that all arguments passed to this function are thoroughly checked and validated to prevent potential code injection.