CWE-502
AllowedDeserialization of Untrusted Data
Abstraction: Base · Status: Draft
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
5669 vulnerabilities reference this CWE, most recent first.
GHSA-6H69-VC2Q-GH29
Vulnerability from github – Published: 2025-11-06 18:32 – Updated: 2026-01-20 15:31Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
{
"affected": [],
"aliases": [
"CVE-2025-48086"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-06T16:15:52Z",
"severity": "CRITICAL"
},
"details": "Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through \u003c= 4.13.3.",
"id": "GHSA-6h69-vc2q-gh29",
"modified": "2026-01-20T15:31:47Z",
"published": "2025-11-06T18:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48086"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H6J-8576-V4XG
Vulnerability from github – Published: 2025-04-28 21:30 – Updated: 2025-11-05 00:31GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.
{
"affected": [],
"aliases": [
"CVE-2025-34489"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-28T19:15:46Z",
"severity": "HIGH"
},
"details": "GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.",
"id": "GHSA-6h6j-8576-v4xg",
"modified": "2025-11-05T00:31:18Z",
"published": "2025-04-28T21:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34489"
},
{
"type": "WEB",
"url": "https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html"
},
{
"type": "WEB",
"url": "https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/gfi-mailessentials-local-privilege-escalation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H76-35RH-GXM9
Vulnerability from github – Published: 2026-08-26 18:31 – Updated: 2026-09-30 18:32ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row's stored data to a hand-written parser that calls unserialize without restricting which classes may be constructed. Any serialised object present in any session row is therefore instantiated on behalf of an anonymous request, and object destructors run when those objects are discarded. A serialised object can be placed into a session row without logging in, because the LTI authentication entry point stores request parameters into the session and is reachable on a path the same initialisation code exempts from authentication. A class bundled with the application writes a JSON-encoded structure to a file named by one of its own properties when it is destroyed, which places attacker-controlled content at an attacker-chosen path below the web root and results in code execution as the web server user. Versions 9.22, 10.10 and 11.3 remove the endpoint's logout-notification implementation.
{
"affected": [],
"aliases": [
"CVE-2026-80428"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T16:16:45Z",
"severity": "CRITICAL"
},
"details": "ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row\u0027s stored data to a hand-written parser that calls unserialize without restricting which classes may be constructed. Any serialised object present in any session row is therefore instantiated on behalf of an anonymous request, and object destructors run when those objects are discarded. A serialised object can be placed into a session row without logging in, because the LTI authentication entry point stores request parameters into the session and is reachable on a path the same initialisation code exempts from authentication. A class bundled with the application writes a JSON-encoded structure to a file named by one of its own properties when it is destroyed, which places attacker-controlled content at an attacker-chosen path below the web root and results in code execution as the web server user. Versions 9.22, 10.10 and 11.3 remove the endpoint\u0027s logout-notification implementation.",
"id": "GHSA-6h76-35rh-gxm9",
"modified": "2026-09-30T18:32:38Z",
"published": "2026-08-26T18:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80428"
},
{
"type": "WEB",
"url": "https://github.com/ILIAS-eLearning/ILIAS/commit/f36934a6f937d0fe837ca6e642986458b4069a95"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui\u0026obj_id=225630\u0026ref_id=35"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui\u0026obj_id=225631\u0026ref_id=35"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui\u0026obj_id=225632\u0026ref_id=35"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui\u0026cmdNode=wy:ll:6t\u0026cmdClass=ilBlogPostingGUI\u0026cmd=previewFullscreen\u0026ref_id=15821\u0026blpg=934"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui\u0026cmdNode=wy:ll:6t\u0026cmdClass=ilBlogPostingGUI\u0026cmd=previewFullscreen\u0026ref_id=15821\u0026blpg=935"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui\u0026cmdNode=wy:ll:6t\u0026cmdClass=ilBlogPostingGUI\u0026cmd=previewFullscreen\u0026ref_id=15821\u0026blpg=936"
},
{
"type": "WEB",
"url": "https://github.com/ILIAS-eLearning/ILIAS"
},
{
"type": "WEB",
"url": "https://schweigertit.de/en/advisories/SIT-2026-002.html"
},
{
"type": "WEB",
"url": "https://schweigertit.de/en/writeups/php-object-injection-shibboleth-logout.html"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/ilias-before-9.22-10.10-and-11.3-unauthenticated-php-object-injection-via-shibboleth-logout-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6HGM-866R-3CJV
Vulnerability from github – Published: 2020-06-15 20:36 – Updated: 2023-05-31 15:55Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.commons:commons-collections4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "commons-collections:commons-collections"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "net.sourceforge.collections:collections-generic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.01"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-6420"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-11T15:58:44Z",
"nvd_published_at": "2015-12-15T05:59:00Z",
"severity": "HIGH"
},
"details": "Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.",
"id": "GHSA-6hgm-866r-3cjv",
"modified": "2023-05-31T15:55:08Z",
"published": "2020-06-15T20:36:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6420"
},
{
"type": "WEB",
"url": "https://arxiv.org/pdf/2306.05534"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/commons-collections"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/581311"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2017-14"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2017-23"
},
{
"type": "WEB",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/78872"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Insecure Deserialization in Apache Commons Collection"
}
GHSA-6HMP-55X3-9HVC
Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:33A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB, thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from, the vulnerability is fixed. This vulnerability affects the entire MapR core platform.
{
"affected": [],
"aliases": [
"CVE-2019-12017"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-24T15:15:00Z",
"severity": "CRITICAL"
},
"details": "A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the \u0027class\u0027 property of the JSON request sent to the CLDB to influence the JSON library\u0027s decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB, thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from, the vulnerability is fixed. This vulnerability affects the entire MapR core platform.",
"id": "GHSA-6hmp-55x3-9hvc",
"modified": "2024-04-04T02:33:51Z",
"published": "2022-05-24T16:59:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12017"
},
{
"type": "WEB",
"url": "https://mapr.com/support/s/article/Remote-code-execution-vulnerability-in-MapR-MFS-CLDB?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HQR-C69M-R76Q
Vulnerability from github – Published: 2024-12-05 12:31 – Updated: 2024-12-05 19:57Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.
In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.hive:hive-exec"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-alpha-1"
},
{
"fixed": "4.0.0-alpha-2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.0-alpha-1"
]
}
],
"aliases": [
"CVE-2022-41137"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-05T19:57:26Z",
"nvd_published_at": "2024-12-05T10:15:04Z",
"severity": "HIGH"
},
"details": "Apache Hive\u00a0Metastore (HMS) uses\u00a0SerializationUtilities#deserializeObjectWithTypeInformation\u00a0method when filtering and fetching partitions that is unsafe and\u00a0can lead\u00a0to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish\u00a0a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.",
"id": "GHSA-6hqr-c69m-r76q",
"modified": "2024-12-05T19:57:26Z",
"published": "2024-12-05T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41137"
},
{
"type": "WEB",
"url": "https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/hive"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/HIVE-26539"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/jwtr3d9yovf2wo0qlxvkhoxnwxxyzgts"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/12/04/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore"
}
GHSA-6HV3-2FGR-8FX3
Vulnerability from github – Published: 2026-09-30 15:31 – Updated: 2026-09-30 15:31Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
{
"affected": [],
"aliases": [
"CVE-2026-94678"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T13:17:27Z",
"severity": "HIGH"
},
"details": "Contributor PHP Object Injection in Go Live Update Urls \u003c= 7.0.8 versions.",
"id": "GHSA-6hv3-2fgr-8fx3",
"modified": "2026-09-30T15:31:27Z",
"published": "2026-09-30T15:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94678"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/go-live-update-urls/vulnerability/wordpress-go-live-update-urls-plugin-7-0-8-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6J24-28G2-2556
Vulnerability from github – Published: 2026-07-01 18:31 – Updated: 2026-07-01 18:31NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-24240"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-01T16:16:44Z",
"severity": "HIGH"
},
"details": "NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.",
"id": "GHSA-6j24-28g2-2556",
"modified": "2026-07-01T18:31:47Z",
"published": "2026-07-01T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24240"
},
{
"type": "WEB",
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5841"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24240"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6J4X-5VG8-WC8V
Vulnerability from github – Published: 2024-08-19 18:32 – Updated: 2026-04-01 18:31Deserialization of Untrusted Data vulnerability in Crew HRM allows Object Injection.This issue affects Crew HRM: from n/a through 1.1.1.
{
"affected": [],
"aliases": [
"CVE-2024-43252"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-19T18:15:11Z",
"severity": "CRITICAL"
},
"details": "Deserialization of Untrusted Data vulnerability in Crew HRM allows Object Injection.This issue affects Crew HRM: from n/a through 1.1.1.",
"id": "GHSA-6j4x-5vg8-wc8v",
"modified": "2026-04-01T18:31:53Z",
"published": "2024-08-19T18:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43252"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/hr-management/vulnerability/wordpress-crew-hrm-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/hr-management/wordpress-crew-hrm-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6JC2-R4QG-63MF
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-15 21:30Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.
{
"affected": [],
"aliases": [
"CVE-2026-49106"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T21:17:20Z",
"severity": "CRITICAL"
},
"details": "Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact \u003c= 1.1.6 versions.",
"id": "GHSA-6jc2-r4qg-63mf",
"modified": "2026-06-15T21:30:49Z",
"published": "2026-06-15T21:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49106"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/cf7-constant-contact/vulnerability/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-1-1-6-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Mitigation
Explicitly define a final object() to prevent deserialization.
Mitigation
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Mitigation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-586: Object Injection
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.