CVE-2024-6441 - ORIPA LoaderXML.java deserialization

Back Back to CVE browser

MEDIUM

ORIPA LoaderXML.java deserialization

Published Jul 2, 2024

5.3

MEDIUM

CVSS 4.0

EPSS 0.43%

Description

A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation leads to deserialization. The attack can be launched remotely. Upgrading to version 1.80 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-270169 was assigned to this vulnerability.

Affected products

Vendor n/a Product Oripa Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
- Version
  1.1
  Status
  affected
  Constraints
  -
- Version
  1.10
  Status
  affected
  Constraints
  -
- Version
  1.11
  Status
  affected
  Constraints
  -
- Version
  1.12
  Status
  affected
  Constraints
  -
- Version
  1.13
  Status
  affected
  Constraints
  -
- Version
  1.14
  Status
  affected
  Constraints
  -
- Version
  1.15
  Status
  affected
  Constraints
  -
- Version
  1.16
  Status
  affected
  Constraints
  -
- Version
  1.17
  Status
  affected
  Constraints
  -
- Version
  1.18
  Status
  affected
  Constraints
  -
- Version
  1.19
  Status
  affected
  Constraints
  -
- Version
  1.2
  Status
  affected
  Constraints
  -
- Version
  1.20
  Status
  affected
  Constraints
  -
- Version
  1.21
  Status
  affected
  Constraints
  -
- Version
  1.22
  Status
  affected
  Constraints
  -
- Version
  1.23
  Status
  affected
  Constraints
  -
- Version
  1.24
  Status
  affected
  Constraints
  -
- Version
  1.25
  Status
  affected
  Constraints
  -
- Version
  1.26
  Status
  affected
  Constraints
  -
- Version
  1.27
  Status
  affected
  Constraints
  -
- Version
  1.28
  Status
  affected
  Constraints
  -
- Version
  1.29
  Status
  affected
  Constraints
  -
- Version
  1.3
  Status
  affected
  Constraints
  -
- Version
  1.30
  Status
  affected
  Constraints
  -
- Version
  1.31
  Status
  affected
  Constraints
  -
- Version
  1.32
  Status
  affected
  Constraints
  -
- Version
  1.33
  Status
  affected
  Constraints
  -
- Version
  1.34
  Status
  affected
  Constraints
  -
- Version
  1.35
  Status
  affected
  Constraints
  -
- Version
  1.36
  Status
  affected
  Constraints
  -
- Version
  1.37
  Status
  affected
  Constraints
  -
- Version
  1.38
  Status
  affected
  Constraints
  -
- Version
  1.39
  Status
  affected
  Constraints
  -
- Version
  1.4
  Status
  affected
  Constraints
  -
- Version
  1.40
  Status
  affected
  Constraints
  -
- Version
  1.41
  Status
  affected
  Constraints
  -
- Version
  1.42
  Status
  affected
  Constraints
  -
- Version
  1.43
  Status
  affected
  Constraints
  -
- Version
  1.44
  Status
  affected
  Constraints
  -
- Version
  1.45
  Status
  affected
  Constraints
  -
- Version
  1.46
  Status
  affected
  Constraints
  -
- Version
  1.47
  Status
  affected
  Constraints
  -
- Version
  1.48
  Status
  affected
  Constraints
  -
- Version
  1.49
  Status
  affected
  Constraints
  -
- Version
  1.5
  Status
  affected
  Constraints
  -
- Version
  1.50
  Status
  affected
  Constraints
  -
- Version
  1.51
  Status
  affected
  Constraints
  -
- Version
  1.52
  Status
  affected
  Constraints
  -
- Version
  1.53
  Status
  affected
  Constraints
  -
- Version
  1.54
  Status
  affected
  Constraints
  -
- Version
  1.55
  Status
  affected
  Constraints
  -
- Version
  1.56
  Status
  affected
  Constraints
  -
- Version
  1.57
  Status
  affected
  Constraints
  -
- Version
  1.58
  Status
  affected
  Constraints
  -
- Version
  1.59
  Status
  affected
  Constraints
  -
- Version
  1.6
  Status
  affected
  Constraints
  -
- Version
  1.60
  Status
  affected
  Constraints
  -
- Version
  1.61
  Status
  affected
  Constraints
  -
- Version
  1.62
  Status
  affected
  Constraints
  -
- Version
  1.63
  Status
  affected
  Constraints
  -
- Version
  1.64
  Status
  affected
  Constraints
  -
- Version
  1.65
  Status
  affected
  Constraints
  -
- Version
  1.66
  Status
  affected
  Constraints
  -
- Version
  1.67
  Status
  affected
  Constraints
  -
- Version
  1.68
  Status
  affected
  Constraints
  -
- Version
  1.69
  Status
  affected
  Constraints
  -
- Version
  1.7
  Status
  affected
  Constraints
  -
- Version
  1.70
  Status
  affected
  Constraints
  -
- Version
  1.71
  Status
  affected
  Constraints
  -
- Version
  1.72
  Status
  affected
  Constraints
  -
- Version
  1.8
  Status
  affected
  Constraints
  -
- Version
  1.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Oripa

n/a

Version	Status	Constraints
1.0	affected	-
1.1	affected	-
1.10	affected	-
1.11	affected	-
1.12	affected	-
1.13	affected	-
1.14	affected	-
1.15	affected	-
1.16	affected	-
1.17	affected	-
1.18	affected	-
1.19	affected	-
1.2	affected	-
1.20	affected	-
1.21	affected	-
1.22	affected	-
1.23	affected	-
1.24	affected	-
1.25	affected	-
1.26	affected	-
1.27	affected	-
1.28	affected	-
1.29	affected	-
1.3	affected	-
1.30	affected	-
1.31	affected	-
1.32	affected	-
1.33	affected	-
1.34	affected	-
1.35	affected	-
1.36	affected	-
1.37	affected	-
1.38	affected	-
1.39	affected	-
1.4	affected	-
1.40	affected	-
1.41	affected	-
1.42	affected	-
1.43	affected	-
1.44	affected	-
1.45	affected	-
1.46	affected	-
1.47	affected	-
1.48	affected	-
1.49	affected	-
1.5	affected	-
1.50	affected	-
1.51	affected	-
1.52	affected	-
1.53	affected	-
1.54	affected	-
1.55	affected	-
1.56	affected	-
1.57	affected	-
1.58	affected	-
1.59	affected	-
1.6	affected	-
1.60	affected	-
1.61	affected	-
1.62	affected	-
1.63	affected	-
1.64	affected	-
1.65	affected	-
1.66	affected	-
1.67	affected	-
1.68	affected	-
1.69	affected	-
1.7	affected	-
1.70	affected	-
1.71	affected	-
1.72	affected	-
1.8	affected	-
1.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47540
Advisory
https://github.com/oripa/oripa/issues/355
issue-tracking
https://github.com/oripa/oripa/milestone/15
patch
https://github.com/oripa/oripa/pull/356/commits/1abf8eb9b6b173d86d277426db1a551d6490c94a
issue-trackingpatch
https://vuldb.com/?ctiid.270169
signaturepermissions-required
https://vuldb.com/?id.270169
vdb-entry
https://vuldb.com/?submit.367350
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47540		Advisory
https://github.com/oripa/oripa/issues/355		issue-tracking
https://github.com/oripa/oripa/milestone/15		patch
https://github.com/oripa/oripa/pull/356/commits/1abf8eb9b6b173d86d277426db1a551d6490c94a		issue-trackingpatch
https://vuldb.com/?ctiid.270169		signaturepermissions-required
https://vuldb.com/?id.270169		vdb-entry
https://vuldb.com/?submit.367350		third-party-advisory