CVE-2020-22083
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 6.5%
jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data
Produtos afetados
n/a · n/aReferências
https://access.redhat.com/security/cve/CVE-2020-22083https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874https://github.com/j0lt-github/python-deserialization-attack-payload-generatorhttps://github.com/jsonpickle/jsonpickle/issues/332https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/