CVE-2022-25845 Deserialization of Untrusted Data

2022-06-1000:00:00

snyk

www.cve.org

deserialization untrusted data

remote servers

safe mode

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

AI Score

9.6

Confidence

High

EPSS

0.022

Percentile

89.5%

JSON

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.

CNA Affected

[
  {
    "product": "com.alibaba:fastjson",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "1.2.83",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]