by Kastro
Paper/Archive/CVE-2022-25845

CVE-2022-25845

snyk — Deserialization of Untrusted Data

EPSS 19%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.3.973 × 2019.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Affected

ProductAffectedFixed inSource
com.alibaba:fastjsonunspecified – < 1.2.831.2.83CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

References

refsnyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222refddosi.org/fastjson-pocrefgithub.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15refgithub.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60drefgithub.com/alibaba/fastjson/wiki/security_update_20220523refgithub.com/alibaba/fastjson/releases/tag/1.2.83reforacle.com/security-alerts/cpujul2022.html