GitHub Advisoryadvisory · Maven

GHSA-jm7r-4pg6-gf26 Esoteric YamlBeans Unsafe Deserialization vulnerability

HIGH Published 2023-08-25 Modified 2023-08-31 Official page ↗
Aliases
CVE-2023-24621
Ecosystem
Maven
Packages
com.esotericsoftware.yamlbeans:yamlbeans
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-08-25

Affected packages

• Maven com.esotericsoftware.yamlbeans:yamlbeans: <= 1.15 (no fix yet)

Description

An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.

Related

Alias · CVE (1)

  • CVE-2023-24621 An issue was discovered in Esoteric YamlBeans through 1.15. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References