CVE-2023-24162 — Vulnerability in cn.hutool:hutool-all — CVE Details

CRITICAL

Dromara Hutool Deserialization of Untrusted Data vulnerability

Published January 31, 2023Updated November 8, 2023Source: osv

Summary

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
cn.hutool:hutool-all	maven	4.0.0, 4.0.1, 4.0.10, 4.0.11 (+174 more)	Range-based data available

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What is CVE-2023-24162?: Dromara Hutool Deserialization of Untrusted Data vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2023-24162?: CVE-2023-24162 affects cn.hutool:hutool-all. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-24162 and 200,000+ other known vulnerabilities.

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

GHSA-77h8-5j3h-jcjf

CVE-2023-24163
CRITICAL
Dromara hutool vulnerable to SQL Injection
CVE-2026-107726
CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
CVE-2023-42277
CRITICAL
hutool Buffer Overflow vulnerability
CVE-2026-107282
CRITICAL
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
CVE-2023-42276
CRITICAL
hutool Buffer Overflow vulnerability
CVE-2025-56769
HIGH
Hutool allows remote code execution (RCE) via the QLExpressEngine class

Scan your dependencies to see if this vulnerability affects your projects.