VULNERABILITY INTELLIGENCE

CVE-2022-25845

CVSS score8.1 HIGH
EPSS probability18.74%
CISA KEVNot currently listed
Published2022-06-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Weakness classification

  • CWE-502: Deserialization of Untrusted Data

Primary references