Deserialization Of Untrusted Data

Spring Framework is vulnerable to deserialization of untrusted data. The vulnerability is due to MappingJackson2MessageConverter and JacksonJsonMessageConverter allowing arbitrary class instantiation from untrusted JMS messages, which allows an attacker to exploit gadget classes during...