Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,305

Image ID Title
CVE-2017-14702 Unsafe Deserialization in ERS Data System (CVE-2017-14702)
CVE-2017-10932 Unsafe Deserialization in Apache (CVE-2017-10932)
CVE-2017-14141 Unsafe Deserialization in Kaltura (CVE-2017-14141)
CVE-2016-8744 Unsafe Deserialization in Apache (CVE-2016-8744)
CVE-2017-12612 Unsafe Deserialization in Apache Spark (CVE-2017-12612)
CVE-2017-14035 Unsafe Deserialization in Crushftp (CVE-2017-14035)
CVE-2017-11153 Unsafe Deserialization in Photo Station (CVE-2017-11153)
CVE-2017-9785 Unsafe Deserialization in NancyFX Nancy (CVE-2017-9785)
CVE-2017-1000034 Unsafe Deserialization in Akka (CVE-2017-1000034)
CVE-2017-1000053 Unsafe Deserialization in Elixir Plug (CVE-2017-1000053)
CVE-2016-6793 Unsafe Deserialization in Apache (CVE-2016-6793)
CVE-2017-11143 Use-After-Free in PHP (CVE-2017-11143)
CVE-2016-4000 Unsafe Deserialization in org.python:jython-standalone (CVE-2016-4000)
CVE-2017-2295 Unsafe Deserialization in Debian Linux (CVE-2017-2295)
CVE-2017-10803 Unsafe Deserialization in Odoo (CVE-2017-10803)
CVE-2017-2292 Unsafe Deserialization in Mcollective (CVE-2017-2292)
CVE-2017-9830 Unsafe Deserialization in Apache (CVE-2017-9830)
CVE-2017-9424 Unsafe Deserialization in IdeaBlade Breeze Breeze.Server.NET (CVE-2017-9424)
CVE-2016-7050 Unsafe Deserialization in Enterprise Linux Desktop (CVE-2016-7050)
CVE-2016-3690 Unsafe Deserialization in Jboss Enterprise Application Platform (CVE-2016-3690)
CVE-2017-5878 Unsafe Deserialization in Media Server (CVE-2017-5878)
CVE-2017-4914 Unsafe Deserialization in VMware vSphere Data Protection (CVE-2017-4914)
CVE-2017-9363 Unsafe Deserialization in Soffid (CVE-2017-9363)
CVE-2017-7504 Unsafe Deserialization in Red Hat Jboss Application Server (CVE-2017-7504)
CVE-2017-8829 Unsafe Deserialization in Lintian (CVE-2017-8829)
CVE-2017-8804 Unsafe Deserialization in Gnu xdr_bytes (CVE-2017-8804)
CVE-2017-7293 Unsafe Deserialization in Dolby (CVE-2017-7293)
CVE-2017-5645 Unsafe Deserialization in Apache Configuration Manager (CVE-2017-5645)
CVE-2016-0779 Unsafe Deserialization in Apache (CVE-2016-0779)
CVE-2016-4483 Unsafe Deserialization in Oracle Solaris (CVE-2016-4483)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details