Lucene search
GitHub Advisory DatabaseGHSA-V54F-XCMP-43CRHistoryFeb 10, 2022 - 8:39 p.m.
Deserialization of Untrusted Data in Apache ShardingSphere
2022-02-1020:39:47
CWE-502
GitHub Advisory Database
github.com
19
0.006 Low
EPSS
Percentile
78.0%
In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.shardingsphere:shardingsphere | le | 4.0.0 |
Related
checkpoint_advisories
checkpoint_advisories
Apache ShardingSphere Insecure Deserialization (CVE-2020-1947)
2020-04-26 00:00:00
cvelist
cvelist
CVE-2020-1947
2020-03-11 20:40:53
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Shardingsphere
2020-05-29 08:07:16
osv
osv
CVE-2020-1947
2020-03-11 21:15:11
Deserialization of Untrusted Data in Apache ShardingSphere
2022-02-10 20:39:47
cve
cve
CVE-2020-1947
2020-03-11 21:15:00
prion
prion
Code injection
2020-03-11 21:15:00