Falhas do tipo CWE-502

3.017 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-64408MEDIUMApache Causeway: Java deserialization vulnerability to authenticated attackersEPSS 11.6%CVE-2021-39152HIGHA Server-Side Forgery Request vulnerability in XStream via HashMap unmarshalingEPSS 11.4%CVE-2022-1118HIGHRockwell Automation ISaGRAF Deserialization of Untrusted DataEPSS 11.1%CVE-2022-36944CRITICALScala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conEPSS 11.0%CVE-2024-28074CRITICALSolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability EPSS 10.9%CVE-2019-12814MEDIUMA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally oEPSS 10.9%CVE-2023-38181HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 10.8%CVE-2020-17531—Deserialization flaw in EOL Tapestry 4.EPSS 10.0%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 9.7%CVE-2025-61810HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 9.5%CVE-2021-40720CRITICALOps CLI Deserialization of Untrusted Data leads to Abritrary Code ExecutionEPSS 9.5%CVE-2025-42928CRITICALDeserialization Vulnerability in SAP jConnect - SDK for ASEEPSS 9.5%CVE-2022-41966HIGHXStream Denial of Service via stack overflow EPSS 9.3%CVE-2026-33439CRITICALPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMEPSS 9.3%CVE-2024-13163HIGHDeserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowEPSS 9.2%CVE-2026-25769CRITICALWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationEPSS 9.1%CVE-2024-9917MEDIUMHuangDou UTCMS template_creat.php deserializationEPSS 8.8%CVE-2019-20330CRITICALFasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.EPSS 8.6%CVE-2020-36184HIGHFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.toEPSS 8.4%CVE-2024-42323HIGHApache HertzBeat: RCE by snakeYaml deser load malicious xmlEPSS 8.3%