CVE-2023-47174

published 2023-10-31

CVE-2023-47174: Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related…

Priority P3 55 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
thorntech	sftp_gateway_firmware	>= 3.4.0 < 3.4.4	3.4.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502