CVE-2022-1471

🗓️ 01 Dec 2022 10:47:07Reported by GoogleType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 847 Views

SnakeYaml Constructor() class allows remote code execution via deserialization

Reporter	Title	Published	Views	Family All 254
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2023	30 Jun 202315:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager April 2023 - Multiple CVEs	22 May 202309:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to SnakeYaml code execution (CVE-2022-1471)	15 Feb 202302:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities were identified in IBM Security Verify Access.	9 Jan 202420:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Axis, Apache Shiro and SnakeYAML affect IBM WebSphere Service Registry and Repository	5 Mar 202416:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	20 Aug 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.5	30 Apr 202418:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global High Availability Mailbox is affected by a SnakeYaml deserialization vulnerability (CVE-2022-1471)	19 Nov 202413:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in snakeYAML	14 Jul 202321:40	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale GUI where remote authenticated attacker can execute an arbitrary code on the system (CVE-2022-1471)	5 Apr 202309:33	–	ibm

NVD

Vulners

Node

snakeyaml_project snakeyamlRange<2.0

[
  {
    "defaultStatus": "unaffected",
    "product": "SnakeYAML",
    "vendor": "SnakeYAML",
    "versions": [
      {
        "lessThanOrEqual": "2.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/mbechler/marshalsec
bitbucket	www.bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in
groups	www.groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
packetstormsecurity	www.packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
openwall	www.openwall.com/lists/oss-security/2023/11/19/1
infosecwriteups	www.infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
github	www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
github	www.github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
security	www.security.netapp.com/advisory/ntap-20230818-0015/
security	www.security.netapp.com/advisory/ntap-20240621-0006/

18 Jun 2025 09:15Current

9.2High risk

Vulners AI Score9.2

CVSS 3.18.3 - 9.8

EPSS0.93849

SSVC