Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2020-11620 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-11620)
CVE-2020-11619 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-11619)
CVE-2020-11111 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-11111)
CVE-2020-11112 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-11112)
CVE-2020-11113 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-11113)
CVE-2020-10969 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-10969)
CVE-2020-10968 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-10968)
CVE-2020-10672 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-10672)
CVE-2020-10673 Unsafe Deserialization in Oracle Weblogic Server (CVE-2020-10673)
CVE-2019-14892 Information Disclosure in Apache (CVE-2019-14892)
CVE-2020-9548 Unsafe Deserialization in Oracle Weblogic Server (CVE-2020-9548)
CVE-2020-9547 Unsafe Deserialization in Oracle Weblogic Server (CVE-2020-9547)
CVE-2020-9546 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2020-9546)
CVE-2020-8840 Unsafe Deserialization in Oracle Apache (CVE-2020-8840)
CVE-2019-20330 Unsafe Deserialization in Oracle Weblogic Server (CVE-2019-20330)
CVE-2016-1000027 Unsafe Deserialization in Vmware Spring Framework (CVE-2016-1000027)
CVE-2019-17571 Unsafe Deserialization in log4j:log4j (CVE-2019-17571)
CVE-2019-17531 Unsafe Deserialization in Apache Weblogic Server (CVE-2019-17531)
CVE-2019-17267 Unsafe Deserialization in Oracle Weblogic Server (CVE-2019-17267)
CVE-2019-16943 Unsafe Deserialization in Oracle Weblogic Server (CVE-2019-16943)
CVE-2019-16942 Unsafe Deserialization in Apache Weblogic Server (CVE-2019-16942)
CVE-2019-16335 Unsafe Deserialization in Oracle Weblogic Server (CVE-2019-16335)
CVE-2019-14540 Unsafe Deserialization in Oracle Weblogic Server (CVE-2019-14540)
CVE-2019-10086 Unsafe Deserialization in Apache Fusion Middleware (CVE-2019-10086)
CVE-2019-14439 Unsafe Deserialization in Oracle Apache (CVE-2019-14439)
CVE-2018-11307 Unsafe Deserialization in FasterXML jackson-databind (CVE-2018-11307)
CVE-2019-12384 Unsafe Deserialization in FasterXML jackson-databind (CVE-2019-12384)
CVE-2019-12086 Unsafe Deserialization in Fasterxml (CVE-2019-12086)
CVE-2018-12022 Unsafe Deserialization in FasterXML jackson-databind (CVE-2018-12022)
CVE-2018-14720 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2018-14720)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details