Weaknesses of type CWE-502

2,661 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2020-35728HIGHFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wlEPSS 12.5%CVE-2022-24082CRITICALIf an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filterEPSS 12.3%CVE-2022-25647HIGHDeserialization of Untrusted DataEPSS 12.2%CVE-2017-11153—Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers EPSS 12.2%CVE-2021-39152HIGHA Server-Side Forgery Request vulnerability in XStream via HashMap unmarshalingEPSS 11.4%CVE-2022-1118HIGHRockwell Automation ISaGRAF Deserialization of Untrusted DataEPSS 11.1%CVE-2024-28074CRITICALSolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability EPSS 10.9%CVE-2022-34668CRITICALNVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileEPSS 10.9%CVE-2019-12814MEDIUMA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally oEPSS 10.9%CVE-2025-36038CRITICALIBM WebSphere Application Server code executionEPSS 10.8%CVE-2025-64408MEDIUMApache Causeway: Java deserialization vulnerability to authenticated attackersEPSS 10.8%CVE-2023-38181HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 10.8%CVE-2022-36944CRITICALScala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conEPSS 10.6%CVE-2020-17531—Deserialization flaw in EOL Tapestry 4.EPSS 10.0%CVE-2026-63077CRITICALIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocolEPSS 9.8%KEVCVE-2025-42928CRITICALDeserialization Vulnerability in SAP jConnect - SDK for ASEEPSS 9.6%CVE-2025-61810HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 9.5%CVE-2021-40720CRITICALOps CLI Deserialization of Untrusted Data leads to Abritrary Code ExecutionEPSS 9.5%CVE-2024-13163HIGHDeserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowEPSS 9.2%CVE-2024-9917MEDIUMHuangDou UTCMS template_creat.php deserializationEPSS 8.8%