CVE-2023-24162

CRITICAL

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS1.3%
Percentile69th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical deserialization vulnerability exists in Dromara Hutool v5.8.11, enabling attackers to execute arbitrary code through the XmlUtil.readObjectFromXml method.

BSID: BS-2023-GLOBAL-062220-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-24162?
A critical deserialization vulnerability exists in Dromara Hutool v5.8.11, enabling attackers to execute arbitrary code through the XmlUtil.readObjectFromXml method.
What is the CVSS score for CVE-2023-24162?
CVE-2023-24162 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2023-24162 actively exploited?
No confirmed active exploitation of CVE-2023-24162 as of 2026-05-30.
How do I remediate CVE-2023-24162?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-24162?
CVE-2023-24162 affects Hutool Hutool.
Vulnerability Details
CVE IDCVE-2023-24162
BSIDBS-2023-GLOBAL-062220-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-01-31
Last Modified2025-03-27
ICS Relevance15%
Weakness (CWE)
Deserialization of Untrusted Data
SourceNVD
Official Description

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation of XML input in the XmlUtil.readObjectFromXml method, allowing an attacker to inject malicious XML that can lead to remote code execution.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Hutool Hutool 5.8.11
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1353 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash5109d667bc4f4d924ee9587b86b84d74a7e3b98b2e993189b216430219b7d7c3983fa2ebcae5d492013912040f81e558cfe7cb445c794f811319b7611d94352a
Related CVEs affecting Hutool
CVE-2023-42276 9.8 hutool v5.8.21 was discovered to contain a buffer overflow via the component ... CVE-2023-42277 9.8 hutool v5.8.21 was discovered to contain a buffer overflow via the component ... CVE-2022-22885 9.8 Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate... CVE-2023-24163 9.8 SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to... CVE-2022-45688 7.5 A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 all...
View all Hutool CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →