CVE-2023-4528

HIGH 7.2CVE-2023-4528 · Published 07/09/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
jscape mft redwood	`< 2023.1.9`	`2023.1.9`

Description

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface

References

jscape.com/blog/binary-management-service-patch-cve-2023-4528 · Vendor Advisory
rapid7.com/blog/post/2023/09/07/cve-2023-4528-java-deserialization-vulnerability-in-jscape-mft-fixed · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free