En bref
- CVE-2022-25845 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant com.alibaba:fastjson, fastjson (alibaba), communications cloud native core unified data repository (oracle).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 18.7%, plus élevée que 97.3% des vulnérabilités.
- Correctif : mettre à jour vers 1.2.83 ou plus récent.
Description
The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.
NVD description
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
Autres vulnérabilités de com.alibaba:fastjson
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free