Description

It was determined that your web application is performing Java object deserialization of user-supplied data. Arbitrary object deserialization is inherently unsafe, and should never be performed on untrusted data. Consult Web references section for more information about this issue.

Remediation

Java object deserialization should not be performed on user-supplied data.

References

The Java Deserialization Bug

AppSecCali 2015 - Marshalling Pickles

What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common?

Related Vulnerabilities

Drupal Improper Input Validation Vulnerability (CVE-2016-9452)

Python Improper Input Validation Vulnerability (CVE-2018-20852)

TYPO3 Improper Input Validation Vulnerability (CVE-2020-15099)

WordPress Plugin Video Embed & Thumbnail Generator 'kg_callffmpeg.php' Multiple Remote Code Execution Vulnerabilities (1.1)

Jetty Improper Input Validation Vulnerability (CVE-2022-2047)

Severity

Medium

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Insecure Deserialization