Описание
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Issue TrackingVendor Advisory
- Vendor Advisory
- Vendor Advisory
- Issue TrackingVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
8.1 High
CVSS3
8.8 High
CVSS3
Дефекты
Связанные уязвимости
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Drools Core Deserialization of Untrusted Data vulnerability
Уязвимость системы управления бизнес-правилами Drools, связана с восстановлением в памяти недостоверных данных, позволяющая нарушителю выполнить произвольный код
EPSS
8.1 High
CVSS3
8.8 High
CVSS3