org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
9.8CVSS
9.5AI Score
0.02EPSS
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
9.8CVSS
9.6AI Score
0.064EPSS
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
5.9CVSS
5.3AI Score
0.001EPSS
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
6.5CVSS
6.3AI Score
0.001EPSS
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% ...
6.5CVSS
6.4AI Score
0.001EPSS
In spring AMQP versions 1.0.0 to2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable classnames were added to Spring AMQP, allowing users to lock down deserialization ofdata in messages from untrusted sources; however by default, when no allowedlist was provided, all classes could b...
5CVSS
4.8AI Score
0.0004EPSS