Fallos del tipo CWE-502

2649 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2025-64408MEDIUMApache Causeway: Java deserialization vulnerability to authenticated attackersEPSS 10.8%CVE-2023-38181HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 10.8%CVE-2022-36944CRITICALScala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conEPSS 10.6%CVE-2020-36184HIGHFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toEPSS 10.4%CVE-2026-33439CRITICALPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMEPSS 10.0%CVE-2020-17531—Deserialization flaw in EOL Tapestry 4.EPSS 10.0%CVE-2025-42928CRITICALDeserialization Vulnerability in SAP jConnect - SDK for ASEEPSS 9.6%CVE-2025-61810HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 9.5%CVE-2021-40720CRITICALOps CLI Deserialization of Untrusted Data leads to Abritrary Code ExecutionEPSS 9.5%CVE-2024-13163HIGHDeserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowEPSS 9.2%CVE-2026-25769CRITICALWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationEPSS 8.8%CVE-2024-9917MEDIUMHuangDou UTCMS template_creat.php deserializationEPSS 8.8%CVE-2022-41966HIGHXStream Denial of Service via stack overflow EPSS 8.8%CVE-2024-42323HIGHApache HertzBeat: RCE by snakeYaml deser load malicious xmlEPSS 8.3%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 8.3%CVE-2021-24579—Bold Page Builder < 3.1.6 - PHP Object InjectionEPSS 8.2%CVE-2017-3207—WebORB for Java by Midnight Coders, version 5.1.1.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserializationEPSS 8.2%CVE-2020-10673HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.coEPSS 8.0%CVE-2023-21710HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 7.9%CVE-2021-20190HIGHA flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The higEPSS 7.5%