Fallos del tipo CWE-502

2661 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2023-21529HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 59.3%KEVCVE-2023-36744HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 57.1%CVE-2019-5434—An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" paraEPSS 57.0%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.2%CVE-2023-50218HIGHInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.0%CVE-2022-23307HIGHA deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.EPSS 54.4%CVE-2021-24307—All in One SEO Pack < 4.1.0.2 - Admin RCE via unserializeEPSS 53.3%CVE-2025-49533CRITICALAdobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)EPSS 52.9%CVE-2024-29847CRITICALDeserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthentiEPSS 52.9%CVE-2024-38023HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 52.9%CVE-2025-32375CRITICALInsecure Deserialization leads to RCE in BentoML's runner serverEPSS 52.4%CVE-2023-36777MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 52.0%CVE-2024-24725HIGHGibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modEPSS 51.3%CVE-2024-38018HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 51.2%CVE-2025-53690CRITICALSitecore Products ViewState Deserialization VulnerabilityEPSS 51.1%KEVCVE-2024-38094HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 50.9%KEVCVE-2023-44351CRITICALAdobe ColdFusion RCE Security VulnerabilityEPSS 50.2%CVE-2021-21342MEDIUMA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostEPSS 50.0%CVE-2017-17485CRITICALFasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix EPSS 49.7%CVE-2023-36756HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 49.2%