Deserialization Of Untrusted Data

2023-07-2602:46:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

deserialization

untrusted data

mysqlsinkdto

arbitrary file read

pojo

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.004

Percentile

73.7%

JSON

manager-pojo is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists because the MySQLSinkDTO.java does not properly check encoding in the MySQL JDBC URLs, which allows an attacker to bypass the current logic and achieve arbitrary file read through the allowLoadLocalInfileInPath parameter.