Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. de.tum.in.ase/artemis-java-test-sandbox
  4. ›
  5. CVE-2024-23683

CVE-2024-23683: Trust Boundary Violation due to Incomplete `Blacklist` in Test Failure Processing in Ares

January 21, 2022 (updated January 22, 2026)

This allows an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system.

References

  • github.com/advisories/GHSA-883x-6fch-6wjx
  • github.com/ls1intum/Ares
  • github.com/ls1intum/Ares/commit/af4f28a56e2fe600d8750b3b415352a0a3217392
  • github.com/ls1intum/Ares/issues/15
  • github.com/ls1intum/Ares/releases/tag/1.7.6
  • github.com/ls1intum/Ares/security/advisories/GHSA-883x-6fch-6wjx
  • nvd.nist.gov/vuln/detail/CVE-2024-23683

Code Behaviors & Features

Detect and mitigate CVE-2024-23683 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.7.6

Fixed versions

  • 1.7.6

Solution

Upgrade to version 1.7.6 or above.

Impact 8.2 HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Learn more about CVSS

Source file

maven/de.tum.in.ase/artemis-java-test-sandbox/CVE-2024-23683.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 05 Feb 2026 00:16:57 +0000.