Lucene search

Veracode Vulnerability DatabaseVERACODE:38005

HistoryNov 15, 2022 - 8:45 a.m.

Deserialization Of Untrusted Data

2022-11-1508:45:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.024 Low

EPSS

Percentile

88.6%

JSON

soap is vulnerable to untrusted data deserialization. The vulnerability exists due to lack of authentication in RPCRouterServlet which allows an attacker to execute arbitrary code in to the system.

CPENameOperatorVersion
soaple2.3.1
soaple2.3.1

CPE	Name	Operator	Version
	soap	le	2.3.1
	soap	le	2.3.1

References

www.openwall.com/lists/oss-security/2022/11/14/4

github.com/advisories/GHSA-789v-h9hw-38pg

lists.apache.org/thread/g4l64s283njhnph2otx7q4gs2j952d31

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.024 Low

EPSS

Percentile

88.6%

JSON

Related for VERACODE:38005