Weaknesses of type CWE-502

2,661 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2025-47732HIGHMicrosoft Dataverse Remote Code Execution VulnerabilityEPSS 3.5%CVE-2021-40719CRITICALAdobe Connect Deserialization of Untrusted Data Remote Code ExecutionEPSS 3.5%CVE-2026-50509HIGHWireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityEPSS 3.5%CVE-2021-24217—Facebook for WordPress < 3.0.0 - PHP Object Injection with POP ChainEPSS 3.5%CVE-2025-3935HIGHScreenConnect Exposure to ASP.NET ViewState Code InjectionEPSS 3.5%KEVCVE-2018-11779—In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the SEPSS 3.5%CVE-2021-41616CRITICALApache ddlutils 1.0 readobject vulnerabilityEPSS 3.5%CVE-2021-39150HIGHA Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshalingEPSS 3.4%CVE-2024-35249HIGHMicrosoft Dynamics 365 Business Central Remote Code Execution VulnerabilityEPSS 3.4%CVE-2016-9483—PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataEPSS 3.4%CVE-2023-38177MEDIUMMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 3.4%CVE-2022-46366CRITICALApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputEPSS 3.4%CVE-2018-15616CRITICALSystem Platform Web UI DeserializationEPSS 3.3%CVE-2020-10650HIGHA deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code executionEPSS 3.3%CVE-2024-22399CRITICALApache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata ServerEPSS 3.3%CVE-2024-47561CRITICALApache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)EPSS 3.3%CVE-2021-21524CRITICALDell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unautEPSS 3.2%CVE-2023-37895CRITICALApache Jackrabbit RMI access can lead to RCEEPSS 3.2%CVE-2021-27460CRITICALRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataEPSS 3.2%CVE-2023-28323CRITICALA deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. ThiEPSS 3.1%