Lucene search
PRIOn knowledge basePRION:CVE-2022-1415HistorySep 11, 2023 - 9:15 p.m.
Design/Logic Flaw
2023-09-1121:15:00
PRIOn knowledge base
www.prio-n.com
9
drools
utility classes
deserialization
code execution
authenticated attacker
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
| CPE | Name | Operator | Version |
|---|---|---|---|
| decision_manager | eq | 7.0 | |
| drools | eq | 7.69.0 | |
| process_automation | eq | 7.0 |
Related
osv
osv
Drools Core Deserialization of Untrusted Data vulnerability
2023-09-11 21:30:17
CVE-2022-1415
2023-09-11 21:15:41
nvd
nvd
CVE-2022-1415
2023-09-11 21:15:41
cvelist
cvelist
CVE-2022-1415 Drools: unsafe data deserialization in streamutils
2023-09-11 20:20:23
github
github
Drools Core Deserialization of Untrusted Data vulnerability
2023-09-11 21:30:17
veracode
veracode
Deserialization Of Untrusted Data
2022-11-08 05:37:24
redhatcve
redhatcve
CVE-2022-1415
2022-10-29 00:16:47
cve
cve
CVE-2022-1415
2023-09-11 21:15:41
ibm
ibm
redhat
redhat