← Volver a CVEs

CVE-2022-25845

HIGH

8.1

Descripcion

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Detalles CVE

Puntuacion CVSS v3.18.1

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado6/10/2022

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

alibaba:fastjsonoracle:communications_cloud_native_core_unified_data_repository

Debilidades (CWE)

CWE-502

Referencias

https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d(report@snyk.io)

https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15(report@snyk.io)

https://github.com/alibaba/fastjson/releases/tag/1.2.83(report@snyk.io)

https://github.com/alibaba/fastjson/wiki/security_update_20220523(report@snyk.io)

https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222(report@snyk.io)

https://www.ddosi.org/fastjson-poc/(report@snyk.io)

https://www.oracle.com/security-alerts/cpujul2022.html(report@snyk.io)

https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/alibaba/fastjson/releases/tag/1.2.83(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/alibaba/fastjson/wiki/security_update_20220523(af854a3a-2127-422b-91ae-364da2661108)

https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222(af854a3a-2127-422b-91ae-364da2661108)

https://www.ddosi.org/fastjson-poc/(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujul2022.html(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.