Remote Code Execution

2020-08-0307:00:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

vulnerability

spring batch

untrusted deserialization

jackson

upgrade

executioncontext

jobrepository

EPSS

0.002

Percentile

58.8%

JSON

spring-batch-core is vulnerable to remote code execution. The upgrade of Jackson in 4.2.3.RELEASE enabled default typing by default and resulted in Spring Batch to be vulnerable to untrusted deserialization. An attacker will be able to execute arbitrary code if ExecutionContext is serialized and the attacker has write access to the data store used by JobRepository.