Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor’s position is that untrusted data is not an intended use case. The product’s behavior will not be changed because some users rely on deserialization of trusted data.
CPE | Name | Operator | Version |
---|---|---|---|
brocade sannav | lt | 2.2.0 | |
brocade sannav | lt | 2.2.2a |