Deserialization of untrusted data

2023-08-2520:15:00

PRIOn knowledge base

www.prio-n.com

vulnerability

java classes

yaml deserialization

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.8%

JSON

An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.

CPENameOperatorVersion
yamlbeansle1.15

CPE	Name	Operator	Version
	yamlbeans	le	1.15

References

contrastsecurity.com

github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md

github.com/EsotericSoftware