Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Divisa Proxia Suite、SparkSpace和Proxia PHR 代码问题漏洞
Vulnerability Description
Divisa Proxia Suite是提供结合了简单性、强大功能、稳健性、可扩展性和安全性的整体解决方案。 Divisa Proxia Suite、SparkSpace和Proxia PHR中存在代码问题漏洞，该漏洞源于dv2eemvc库以不安全的方式反序列化了cookie。攻击者可借助序列化的payload利用该漏洞执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A