CVE-2024-23682: Artemis java test sandbox Class Loading Vulnerability Vulnerability
HIGHCVE-2024-23682 is a HIGH (CVSS 8.2) class loading vulnerability vulnerability (CWE-501: Trust Boundary Violation) affecting Artemis java test sandbox libraries in the Maven ecosystem. The issue involves class loading vulnerability in artemis. Remediation is available by upgrading affected packages to version 1.8.0.
CVE-2024-23682 at a Glance
Security Impact
CVSS: 8.2
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
How to Fix CVE-2024-23682
To remediate this vulnerability, upgrade all affected Artemis java test sandbox dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>de.tum.in.ase</groupId>
<artifactId>artemis-java-test-sandbox</artifactId>
<version>1.8.0</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=de.tum.in.aseHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2024-23682, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=de.tum.in.aseAnalyze the terminal output to locate any version of Artemis java test sandbox in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.8.0), your application is affected.
Note: The mvn dependency:tree -Dincludes=de.tum.in.ase command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-501: Trust Boundary Violation, where the product mixes trusted and untrusted data in the same data structure or structured message. In Artemis java test sandbox, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-23682 Affected Artemis java test sandbox Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
de.tum.in.ase:artemis-java-test-sandbox
|
Maven |
< 1.8.0
|
1.8.0
|
References
Frequently Asked Questions
What is CVE-2024-23682?
Which Artemis java test sandbox versions are affected?
What version fixes CVE-2024-23682?
Is artemis-java-test-sandbox affected?
What is the CVSS score of CVE-2024-23682?
What CWE is associated with CVE-2024-23682?
How can I check Maven dependencies for CVE-2024-23682?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-227w-wv4j-67h4",
"modified" : "2026-01-22T20:53:41Z",
"published" : "2022-02-09T22:30:30Z",
"aliases" : [ "CVE-2024-23682" ],
"summary" : "Class Loading Vulnerability in Artemis",
"details" : "### Impact\nThis affects all Artemis users who test Java assignments. **Ares is not required.**\nStudents code that gets automatically tested can run arbitrary code in the container,\nor arbitrary code on the machine of an assessor in case of manual correction.\n\n### Patches\nThe problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:\n\n```xml\n<plugin>\n <groupId>org.apache.maven.plugins</groupId>\n <artifactId>maven-enforcer-plugin</artifactId>\n <version>3.0.0</version>\n <executions>\n <execution>\n <id>enforce-no-student-code-in-trusted-packages</id>\n <phase>process-classes</phase>\n <goals>\n <goal>enforce</goal>\n </goals>\n </execution>\n </executions>\n <configuration>\n <rules>\n <requireFilesDontExist>\n <files>\n <!-- ADD HERE THE RULES ARES TELLS YOU ARE MISSING -->\n </files>\n </requireFilesDontExist>\n </rules>\n </configuration>\n</plugin>\n```\n\nThis fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using `@AddTrustedPackage` should be added as well.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion https://github.com/ls1intum/Ares/discussions\n* Open an issue in https://github.com/ls1intum/Ares/issues\n* Email us, see https://github.com/ls1intum/Ares/security/policy\n\n### References\nSee the assignment of Julius that passes the tests in TUM Artemis course: \"Test - Praktikum: Grundlagen der Programmierung (Testkurs für Tutoren) - Security Tests\" (if that still exists in 2022).\n\nAlso see #15 for almost the same problem.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "de.tum.in.ase:artemis-java-test-sandbox"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.8.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/ls1intum/Ares/security/advisories/GHSA-227w-wv4j-67h4"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-23682"
}, {
"type" : "WEB",
"url" : "https://github.com/ls1intum/Ares/issues/15"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/ls1intum/Ares"
}, {
"type" : "WEB",
"url" : "https://github.com/ls1intum/Ares/releases/tag/1.8.0"
}, {
"type" : "WEB",
"url" : "https://vulncheck.com/advisories/vc-advisory-GHSA-227w-wv4j-67h4"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-501", "CWE-653" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2022-02-09T22:30:30Z",
"nvd_published_at" : null
}
}