An unpatched remote code execution (RCE) vulnerability in Nepxion Discovery, an open source project that provides functionality for the Spring Cloud framework, has been made public.
Security researchers from GitHub Security Lab (GHSL) disclosed the vulnerability, alongside an additional information disclosure flaw in Nepxion Discovery on September 9.
Nepxion, a China-based vendor, maintains several open source projects related to Spring Cloud.
Despite the Nepxion Discovery GitHub page having over 1,300 forks, the security policy page is disabled and the security advisories tab is empty.
In a blog post, GHSL researcher Jorge Rosillo said the most severe vulnerability, tracked as GHSL-2022-033 (CVE-2022-23463), is a critical issue in the discovery-commons function that renders the software vulnerable to SpEL Injection.
SpEL Injection attacks occur when there is a lack of protection to stop user input from passing directly to a SpEL expression parser. In this case, two endpoints turn user input into expressions, pass them through, and input is then allowed to interact with Java classes – including java.lang.Runtime – leading to RCE.
Due to the severity, this vulnerability was assigned a CVSS score of 9.8.
The second issue, tracked as GHSL-2022-033 (CVE-2022-23464) and issued a can GitHub score of 4.3 (NIST 7.5), is a server-side request forgery (SSRF) flaw that could result in information leaks.
According to the GHSL, no patch has been made available, and there are no known workarounds for either vulnerability. The issues impact Nepxion Discovery versions 6.16.2 and below.
The cybersecurity researchers privately disclosed their findings to Nepxion on May 22. In June, the team requested a security contact and, with no response forthcoming, a public issue was opened on June 20.
The maintainers closed the public issue on August 9.
By August 21, the standard vulnerability disclosure process deadline had expired, leading to the assignment of CVE-2022-23463 and CVE-2022-23464 and public disclosure.
When approached for comment, GitHub pointed us to the original disclosure.
Nepxion has yet to respond to queries submitted by The Daily Swig, but we will update this article if and when we hear back.
All Time Argentina’s Top Goal Scorer At The FIFA World Cup
Will There Be Wednesday (Tv Series) Season 2, Release Date, Cast, Latest News
Portugal Coach Fire-back at Ronaldo For Sub Reaction
[STORY] TIMISIRE THE GOLDEN GIRL (Episode 22)
[STORY] BEHIND THE FINE FACE (Episode 08)
Actress, Keke Palmer announces pregnancy during ‘Saturday Night Live’
2023: Time to liberate yourself, vote out APC – Atiku to Lagosians
2023: INEC to meet NCC, telcos, on Tuesday
FIFA World Cup 2022: Croatia beat Japan on penalties to reach World Cup quarter-finals
GraphQL password hash leak problem fixed in Ibexa DXP
Gunmen kidnap Benue Commissioner for Housing
Adeleke threatens to penalize MDAs, starts payment of salaries
FG slams Atiku, ‘You live in Dubai’, you don’t really know Nigeria
Tinubu criticizes Arise TV, claiming they wish to profit from him
Tinubu Speaks about the debate surrounding his birth certificate and birth date
Singer AV drops highly anticipated debut EP, ‘Thug Love’
I’m disappointed – Blaqbonez reacts to Wizkid’s comments
South Africa parliament to vote on Ramaphosa’s impeachment Tuesday
OAU to graduate 5,852 students, 130 bag first class
Oseni: “If I Am To Start With Him, Reno Will Not Exist” – Reno Shares New Audio
Atiku has no moral basis to criticise Buhari — Lai Mohammed
Elon Musk says risk of him being assassinated is ‘quite significant’
Variation in the Types of Cryptocurrencies
Factors To Consider Before Choosing Bitcoin Exchange
Things You Should Know About Bitcoin Statistics: Future Trends
Bitcoin For Beginners: An Informative Report On The Digital Currency
Oil can’t feed Nigeria anymore – Obasanjo
Sesame Street Icon, Bob McGrath Dies At 90
Sigourney Weaver channelled her own teenage self into role 14-year-old Na’vi Kiri in Avatar: The Way of Water
Kate Winslet was ‘traumatised’ by Titanic – James Cameron
Jude Bellingham defends Liverpool star after England win
Gilberto Silva promises to speak to Edu about signing England star
Harry Kane praises team’s mentality after beating Senegal
Raheem Sterling to leave England’s World Cup camp after armed robbery
Your daily horoscope for Monday, December 5, 2022
NNPC not sincere about oil theft, exaggerating figures – Navy
FIFA World Cup 2022: Giroud and Mbappe break records as France reach World Cup quarter-finals
“I Owe No One Apology For Commending Buhari”: Wike To PDP Members
NCC Reveals List Of Unapproved Phones In Nigerian Markets To Be Avoided
Greetings flow in as Buhari and Aisha celebrate 33 years of marriage
DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
DOWNLOAD Complete Troll (2022 film) Subtitles File [English SRT] 2022
DOWNLOAD Complete My Name Is Vendetta (2022 film) Subtitles File [English SRT] 2022
[STORY] THE VIRGIN WIFE (Complete Episodes)
[STORY] BEHIND THE FINE FACE (Complete Episodes)
[Music] Timaya – Sweet Us (As e Dey Sweet Us e Dey Pain Dem)
Top 10 Celebrities With Brazilian Butt Lift Surgery (BBL) [PHOTOS]
[STORY] THE VIRGIN WIFE (Episode 06)
[STORY] THE VIRGIN WIFE (Episode 07)
[STORY] THE VIRGIN WIFE (Episode 01)
[STORY] THE VIRGIN WIFE (Episode 02)
[STORY] THE VIRGIN WIFE (Episode 12)
[STORY] THE VIRGIN WIFE (Episode 05)
[STORY] THE VIRGIN WIFE (Final Episode 13)
[STORY] THE VIRGIN WIFE (Episode 04)
[STORY] THE VIRGIN WIFE (Episode 10)
[STORY] THE VIRGIN WIFE (Episode 03)
[STORY] THE VIRGIN WIFE (Episode 08)
Your daily horoscope for Thursday, December 1, 2022
[STORY] BEHIND THE FINE FACE (Episode 01)
[STORY] DIARY OF A PASTOR’S SON (Complete Episodes)
Top 5 Richest Kid Nigerian Skit Makers And How Their Networth
[STORY] BEHIND THE FINE FACE (Episode 04)
Who Manchester United should sign instead of Cody Gakpo – Sven-Goran Eriksson
Kehlani Goes Viral After Flirting With Underage Girl At Concert
[STORY] BEHIND THE FINE FACE (Episode 02)
[STORY] THE VIRGIN WIFE (Episode 11)
DOWNLOAD Complete Blood & Water (TV series) (2022 film) Season 3 Subtitles File [English SRT] 2022
[STORY] BEHIND THE FINE FACE (Episode 03)
Antony blames Qatar’s air conditioning for World Cup illness
[STORY] THE VIRGIN WIFE (Episode 09)
Timaya – Sweet Us [Lyrics]
[STORY] BEHIND THE FINE FACE (Episode 05)
[STORY] TIMISIRE THE GOLDEN GIRL (Episode 20)
Victoria Chintex assassinated in Kaduna State
Chelsea set to sign Andrey Santos in January
Buhari Appoints Hairdresser As Boss Of Financial Institution – Lawyers Demand Sack
[STORY] DIARY OF A PASTOR’S SON (Episode 01)
[STORY] DIARY OF A PASTOR’S SON (Episode 02)
Cardi B Threatens To Murder Comedian Nicole Arbour’s Mother
ANE Billboard Hots
Technology5 months ago
VoIP Number: Everything You Need To Know
Movie Subtitle2 weeks ago
DOWNLOAD Complete Black Adam (2022 film) Subtitles File [English SRT] 2022
Music3 years ago
[Music] Gnash Ft Olivia O’Brien – I Hate you, I Love you
Music5 months ago
[Music] Akon – Sorry Blame It On Me
Music5 months ago
Alan Walker – Faded [INSTRUMENTAL]
Music5 months ago
[Instrumental] Wiz Khalifa – See You Again ft. Charlie Puth
Music5 months ago
[INSTRUMENTAL] John Legend – All Of Me
Music5 months ago
[Video] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me