Arbitrary Code Execution

org.noear:solon.serialization.hessian is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists in HessianActionExecutor.java because it blindly deserializes data without validation which allows an attacker to inject and execute arbitrary code...