Severity
High
Analysis Summary
CVE-2023-28754
Apache ShardingSphere-Agent could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the java.net.URLClassLoader component. By using specially crafted YAML configuration file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Impact
- Code Execution
Indicators Of Compromise
CVE
- CVE-2023-28754
Affected Vendors
Apache
Affected Products
- Apache ShardingSphere-Agent 5.3.2
Remediation
Upgrade to the latest version of ShardingSphere-Agent, available from the Apache Web site.