-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper trust boundary enforcement in class loading. The advisory explicitly states the issue occurs when attacker-controlled classes reside in trusted packages. The CWE-501 (Trust Boundary Violation) classification confirms this pattern. While specific function names aren't provided in the advisory, the: 1) Reference to class files in trusted packages, 2) Mitigation requiring package validation via Maven Enforcer, and 3) Historical issue (#15) discussing ClassLoader security improvements, all indicate the core vulnerability lies in the class loading mechanism's failure to validate package trustworthiness before loading classes. The patch (1.8.0) likely added package validation checks in the ClassLoader workflow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| de.tum.in.ase:artemis-java-test-sandbox | maven | < 1.8.0 | 1.8.0 |