CVE-2023-5183 CRITICAL

CVE-2023-5183: Authenticated RCE due to unsafe JSON deserialization

Vendor Illumio
Product Core PCE
Weakness CWE-502 · Unsafe deserialization
Published September 26, 2023
Last update September 24, 2024
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can leverage this vulnerability to execute code in the context of the PCE’s operating system user.  

Key dates

02Disclosure timeline

September 26, 2023 CVE published
September 24, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-60083 WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability CVE-2026-24954 WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints CVE-2025-49434 WordPress Cars4Rent Theme <= 1.4.2 - PHP Object Injection Vulnerability CVE-2025-39358 WordPress WP Posts Carousel <= 1.3.12 - PHP Object Injection Vulnerability