Deserialization of untrusted data

2021-02-1818:15:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.012 Low

EPSS

Percentile

85.0%

JSON

KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter.

CPENameOperatorVersion
kollecteq< 4.8.16c

CPE	Name	Operator	Version
	kollect	eq	< 4.8.16c

References

hacked0x90.net/index.php/2021/02/15/kollectapp-insecure-java-deserialization/