Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2018-19361 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2018-19361)
CVE-2018-19360 Unsafe Deserialization in com.fasterxml.jackson.core:jackson-databind (CVE-2018-19360)
CVE-2018-14719 Unsafe Deserialization in FasterXML jackson-databind (CVE-2018-14719)
CVE-2018-14718 Unsafe Deserialization in FasterXML jackson-databind (CVE-2018-14718)
CVE-2018-19362 Unsafe Deserialization in FasterXML jackson-databind (CVE-2018-19362)
CVE-2018-7489 Vulnerability in FasterXML jackson-databind (CVE-2018-7489)
CVE-2017-15095 Vulnerability in Oracle Fasterxml (CVE-2017-15095)
CVE-2017-7525 Vulnerability in Oracle Fasterxml (CVE-2017-7525)
CVE-2018-5968 Vulnerability in FasterXML jackson-databind (CVE-2018-5968)
CVE-2014-9515 Unsafe Deserialization in Dozer Project (CVE-2014-9515)
CVE-2017-5641 Unsafe Deserialization in Apache (CVE-2017-5641)
CVE-2017-17672 Unsafe Deserialization in Vbulletin (CVE-2017-17672)
CVE-2017-11283 Unsafe Deserialization in Adobe Coldfusion (CVE-2017-11283)
CVE-2017-11284 Unsafe Deserialization in Adobe Coldfusion (CVE-2017-11284)
CVE-2017-1000207 Unsafe Deserialization in Swagger-Parser's (CVE-2017-1000207)
CVE-2017-4995 Unsafe Deserialization in Pivotal Spring Security (CVE-2017-4995)
CVE-2017-8045 Unsafe Deserialization in Pivotal Spring AMQP (CVE-2017-8045)
CVE-2017-1000248 Unsafe Deserialization in Redis Store (CVE-2017-1000248)
CVE-2017-1000208 Unsafe Deserialization in Swagger-Parser's (CVE-2017-1000208)
CVE-2017-1000195 Unsafe Deserialization in Octobercms (CVE-2017-1000195)
CVE-2017-12633 Unsafe Deserialization in Apache (CVE-2017-12633)
CVE-2017-12634 Unsafe Deserialization in Apache (CVE-2017-12634)
CVE-2015-7501 Unsafe Deserialization in Apache (CVE-2015-7501)
CVE-2017-1000148 Unsafe Deserialization in Mahara (CVE-2017-1000148)
CVE-2016-5003 Unsafe Deserialization in Apache (CVE-2016-5003)
CVE-2017-12796 Unsafe Deserialization in Reporting Compatibility Add On (CVE-2017-12796)
CVE-2017-12628 Unsafe Deserialization in Apache (CVE-2017-12628)
CVE-2015-5164 Unsafe Deserialization in Pulpproject (CVE-2015-5164)
CVE-2016-8736 Unsafe Deserialization in Apache (CVE-2016-8736)
CVE-2017-0903 Unsafe Deserialization in RubyGems (CVE-2017-0903)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details