Homepage
About Snyk

org.pac4j:pac4j-core@3.0.0-RC2 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.pac4j:pac4j-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Deserialization of Untrusted Data

org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the handling of serialized Java objects inside the InternalAttributeHandler#prepare method. An attacker can execute arbitrary code by providing a specially crafted attribute that contains a serialized object with a specific prefix and Base64 encoding.

How to fix Deserialization of Untrusted Data?

Upgrade org.pac4j:pac4j-core to version 4.0.0 or higher.

[,4.0.0)
Go back to all versions of this package