{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"de.tum.in.ase:artemis-java-test-sandbox","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"1.8.0","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"de.tum.in.ase:artemis-java-test-sandbox","product":"de.tum.in.ase:artemis-java-test-sandbox","source":"OSV GHSA-227w-wv4j-67h4","vendor":"","versions":[{"status":"affected","version":"1.0.0","versionType":"Maven"},{"status":"affected","version":"1.0.1","versionType":"Maven"},{"status":"affected","version":"1.1.0","versionType":"Maven"},{"status":"affected","version":"1.1.1","versionType":"Maven"},{"status":"affected","version":"1.2.0","versionType":"Maven"},{"status":"affected","version":"1.2.1","versionType":"Maven"},{"status":"affected","version":"1.2.2","versionType":"Maven"},{"status":"affected","version":"1.3.0","versionType":"Maven"},{"status":"affected","version":"1.3.1","versionType":"Maven"},{"status":"affected","version":"1.3.2","versionType":"Maven"},{"status":"affected","version":"1.3.3","versionType":"Maven"},{"status":"affected","version":"1.3.4","versionType":"Maven"},{"status":"affected","version":"1.4.0","versionType":"Maven"},{"status":"affected","version":"1.4.1","versionType":"Maven"},{"status":"affected","version":"1.4.2","versionType":"Maven"},{"status":"affected","version":"1.4.3","versionType":"Maven"},{"status":"affected","version":"1.4.4","versionType":"Maven"},{"status":"affected","version":"1.4.5","versionType":"Maven"},{"status":"affected","version":"1.4.6","versionType":"Maven"},{"status":"affected","version":"1.4.7","versionType":"Maven"},{"status":"affected","version":"1.5.0","versionType":"Maven"},{"status":"affected","version":"1.5.1","versionType":"Maven"},{"status":"affected","version":"1.5.2","versionType":"Maven"},{"status":"affected","version":"1.5.3","versionType":"Maven"},{"status":"affected","version":"1.5.4","versionType":"Maven"},{"status":"affected","version":"1.5.5","versionType":"Maven"},{"status":"affected","version":"1.6.0","versionType":"Maven"},{"status":"affected","version":"1.7.0","versionType":"Maven"},{"status":"affected","version":"1.7.1","versionType":"Maven"},{"status":"affected","version":"1.7.2","versionType":"Maven"},{"status":"affected","version":"1.7.3","versionType":"Maven"},{"status":"affected","version":"1.7.5","versionType":"Maven"},{"status":"affected","version":"1.7.6","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"1.8.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23682","cwes":["CWE-501","CWE-653"],"description":"Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.","epss":{"date":"2026-11-08","percentile":0.288,"score":0.0035},"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794146399024,"publishedAt":1705695235453,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4"},{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/ls1intum/Ares/issues/15"},{"source":"CNA: VulnCheck","tags":["related","release-notes"],"url":"https://github.com/ls1intum/Ares/releases/tag/1.8.0"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-227w-wv4j-67h4"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4"},{"source":"ADP: CVE","tags":["issue-tracking","x_transferred"],"url":"https://github.com/ls1intum/Ares/issues/15"},{"source":"ADP: CVE","tags":["related","x_transferred"],"url":"https://github.com/ls1intum/Ares/releases/tag/1.8.0"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-227w-wv4j-67h4"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-227w-wv4j-67h4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-227w-wv4j-67h4"}],"remediation":[{"kind":"fix","source":"OSV GHSA-227w-wv4j-67h4","text":"de.tum.in.ase:artemis-java-test-sandbox (Maven): OSV reports a fixed version 1.8.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-227w-wv4j-67h4"}],"revision":"b9c434c4270cec8cb780a8cc6d26ccd03bcbc6c21c07f8f6d1b104d5998cdfed","sources":[{"modifiedAt":1794146399024,"name":"CNA: VulnCheck","retrievedAt":1794146932541,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23682"},{"modifiedAt":1783493587550,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146932976,"url":"https://osv.dev/vulnerability/GHSA-227w-wv4j-67h4"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150558589,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23682"}],"ssvc":{"assessedAt":1705937856607,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Artemis Java Test Sandbox Class Loading Escape","updatedAt":1794150558589}