Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2021-21345 Code Injection in com.thoughtworks.xstream:xstream (CVE-2021-21345)
CVE-2021-21343 Vulnerability in com.thoughtworks.xstream:xstream (CVE-2021-21343)
CVE-2021-21346 Unrestricted File Upload in com.thoughtworks.xstream:xstream (CVE-2021-21346)
CVE-2020-24914 Unsafe Deserialization in Qcubed (CVE-2020-24914)
CVE-2020-24036 Unsafe Deserialization in Fork Cms (CVE-2020-24036)
CVE-2021-20190 Unsafe Deserialization in Oracle Apache (CVE-2021-20190)
CVE-2020-36183 Unsafe Deserialization in Oracle Apache (CVE-2020-36183)
CVE-2020-36179 Unsafe Deserialization in Oracle Apache (CVE-2020-36179)
CVE-2020-36180 Unsafe Deserialization in Oracle Apache (CVE-2020-36180)
CVE-2020-36182 Unsafe Deserialization in Apache Tomcat (CVE-2020-36182)
CVE-2020-36184 Unsafe Deserialization in Apache Tomcat (CVE-2020-36184)
CVE-2020-36185 Unsafe Deserialization in Apache Tomcat (CVE-2020-36185)
CVE-2020-36186 Unsafe Deserialization in Apache Tomcat (CVE-2020-36186)
CVE-2020-36187 Unsafe Deserialization in Apache Tomcat (CVE-2020-36187)
CVE-2020-36188 Unsafe Deserialization in FasterXML jackson-databind (CVE-2020-36188)
CVE-2020-36189 Unsafe Deserialization in FasterXML jackson-databind (CVE-2020-36189)
CVE-2020-36181 Unsafe Deserialization in Apache Tomcat (CVE-2020-36181)
CVE-2020-35728 Unsafe Deserialization in Oracle Apache (CVE-2020-35728)
CVE-2020-35490 Unsafe Deserialization in Oracle Apache (CVE-2020-35490)
CVE-2020-35491 Unsafe Deserialization in Apache Sd Wan Edge (CVE-2020-35491)
CVE-2020-24750 Unsafe Deserialization in FasterXML jackson-databind (CVE-2020-24750)
CVE-2020-24616 Unsafe Deserialization in FasterXML jackson-databind (CVE-2020-24616)
CVE-2020-14195 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-14195)
CVE-2018-12023 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2018-12023)
CVE-2020-14060 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-14060)
CVE-2020-14061 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-14061)
CVE-2020-14062 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-14062)
CVE-2020-5411 Unsafe Deserialization in Broadcom Spring Batch (CVE-2020-5411)
CVE-2020-9484 Unsafe Deserialization in org.apache.tomcat:tomcat-catalina (CVE-2020-9484)
CVE-2019-14893 Information Disclosure in com.fasterxml.jackson.core:jackson-databind (CVE-2019-14893)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details