En resumen
- CVE-2022-25845 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a com.alibaba:fastjson, fastjson (alibaba), communications cloud native core unified data repository (oracle).
- Probabilidad de explotación en los próximos 30 días (EPSS): 18.7%, mayor que el 97.3% de las vulnerabilidades.
- Solución: actualizar a 1.2.83 o posterior.
Description
The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.
NVD description
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
Más vulnerabilidades de com.alibaba:fastjson
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free