Weaknesses of type CWE-502

2,661 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2024-28988CRITICALSolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilityEPSS 39.4%CVE-2023-36050HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 39.2%CVE-2023-49442CRITICALDeserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POSEPSS 38.5%CVE-2022-21647HIGHDeserialization of Untrusted Data in Codeigniter4EPSS 37.7%CVE-2023-36757HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 36.9%CVE-2020-17144HIGHMicrosoft Exchange Remote Code Execution VulnerabilityEPSS 36.5%KEVCVE-2024-43464HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 36.3%CVE-2022-31199CRITICALRemote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix AuditoEPSS 36.0%KEVCVE-2022-23450—A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versionsEPSS 35.7%CVE-2023-37941MEDIUMApache Superset: Metadata db write access can lead to remote code executionEPSS 35.5%CVE-2025-71260HIGHBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCEEPSS 34.4%CVE-2023-1650CRITICALChatBot < 4.4.7 - Unauthenticated PHP Object InjectionEPSS 34.4%CVE-2024-1651CRITICALTorrentpier 2.4.1 - RCEEPSS 34.2%CVE-2026-20251HIGHRemote Code Execution through Deserialization of Untrusted Data in Splunk Secure GatewayEPSS 32.2%CVE-2023-3001HIGH A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious pEPSS 31.9%CVE-2023-4528HIGHJSCAPE MFT Server Unsafe Deserialization on Management PortEPSS 31.9%CVE-2025-0994HIGHTrimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vEPSS 31.3%KEVCVE-2025-30285HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 30.9%CVE-2024-21318HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 30.8%CVE-2024-41874CRITICALColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 30.3%