CVE-2022-25845high

CVE-2022-25845: fallo de gravedad alta en com.alibaba:fastjson

Deserialization of Untrusted Data

Publicada el · Actualizada el

26Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 19%
probabilidad de explotación
19%top 3% de las CVE
explotación observada
noninguna fuente lo reporta
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Productos afectados
n/a · com.alibaba:fastjson
Referencias
https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60dhttps://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15https://github.com/alibaba/fastjson/releases/tag/1.2.83https://github.com/alibaba/fastjson/wiki/security_update_20220523https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222https://www.ddosi.org/fastjson-poc/https://www.oracle.com/security-alerts/cpujul2022.html