A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
References
| Link | Resource |
|---|---|
| https://github.com/mvel/mvel/issues/348 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/mvel/mvel/issues/348#issuecomment-1874047271 | |
| https://github.com/mvel/mvel/issues/348 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/mvel/mvel/issues/348#issuecomment-1874047271 |
Configurations
History
21 Nov 2024, 08:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mvel/mvel/issues/348 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://github.com/mvel/mvel/issues/348#issuecomment-1874047271 - |
10 Jan 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task." | |
| References |
|
08 Jan 2024, 14:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mvel:mvel:2.5.0:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| References | () https://github.com/mvel/mvel/issues/348 - Exploit, Issue Tracking, Third Party Advisory | |
| First Time |
Mvel mvel
Mvel |
27 Dec 2023, 21:37
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-27 21:15
Updated : 2024-11-21 08:37
NVD link : CVE-2023-51079
Mitre link : CVE-2023-51079
CVE.ORG link : CVE-2023-51079
JSON object : View
Products Affected
mvel
- mvel
CWE