Fallos del tipo CWE-502

3027 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2024-22320CRITICALIBM Operational Decision Manager code executionEPSS 73.4%CVE-2018-0824HIGHA remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "MicrosEPSS 73.0%KEVCVE-2023-36039HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 73.0%CVE-2020-5741HIGHDeserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.EPSS 72.9%KEVCVE-2021-21345MEDIUMXStream is vulnerable to a Remote Command Execution attackEPSS 72.3%CVE-2022-26133CRITICALSharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6EPSS 70.6%CVE-2023-20864CRITICALVMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware EPSS 70.4%CVE-2019-17571CRITICALIncluded in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeEPSS 70.0%CVE-2021-35215HIGHActionPluginBaseView Deserialization of Untrusted Data RCEEPSS 69.9%CVE-2023-38204CRITICALBypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8EPSS 69.7%CVE-2024-54676CRITICALApache OpenMeetings: Deserialisation of untrusted data in cluster modeEPSS 68.8%CVE-2023-6933HIGHBetter Search Replace <= 1.4.4 - Unauthenticated PHP Object InjectionEPSS 68.0%CVE-2025-40553CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 68.0%CVE-2022-38108HIGHSolarWinds Platform Deserialization of Untrusted DataEPSS 66.6%CVE-2021-42127—A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execuEPSS 65.8%CVE-2023-44350CRITICALColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 64.6%CVE-2021-40865—Unsafe Pre-Authentication Deserialization In WorkersEPSS 64.2%CVE-2023-39475CRITICALInductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 64.1%CVE-2022-23302HIGHDeserialization of untrusted data in JMSSink in Apache Log4j 1.xEPSS 63.8%CVE-2023-39473HIGHInductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 62.5%