Skip to content
OpenAdvisories

Weakness (CWE)

CWE-502: Deserialization of Untrusted Data

Base Draft

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

How to prevent it (7 mitigations)

  1. Architecture and Design, Implementation

    If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

  2. Implementation

    When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

  3. Implementation

    Explicitly define a final object() to prevent deserialization.

  4. Architecture and Design, Implementation

    Make fields transient to protect them from deserialization.

    An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

  5. Implementation

    Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.

  6. Architecture and Design, Implementation

    Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.

  7. Operation

    Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Source: MITRE CWE-502

All Critical High Medium Low Exploited only Public exploit

56 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-10189 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-0618 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles pag…

    Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) Microsoft SQL Server Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)
    KEV Sep 18, 2024
  • Critical 9.8
    CVE-2020-2555 Exploited Public exploit EPSS 97%

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…

    Oracle WebCenter Portal Utilities Framework
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-18935 Exploited · Ransomware Public exploit EPSS 100%

    Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-0344 Exploited

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 18…

    SAP SAP Commerce Cloud (virtualjdbc extension)
    KEV Sep 30, 2024
  • Critical 9.8
    CVE-2019-9874 Exploited Scanner template EPSS 84%

    Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 a…

    KEV Mar 26, 2025
  • Critical 9.8
    CVE-2019-10068 Exploited Public exploit Scanner template EPSS 95%

    An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x version…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2018-1000861 Exploited Public exploit Scanner template EPSS 98%

    Deserialization of Untrusted Data in Jenkins

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by acce…

    org.jenkins-ci.main:jenkins-core Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2018-4939 Exploited EPSS 62%

    Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deseri…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-2628 Exploited Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). …

    Oracle WebLogic Server
    KEV Sep 8, 2022
  • Critical 9.8
    CVE-2017-1000353 Exploited Public exploit EPSS 100%

    Deserialization of Untrusted Data in Jenkins

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…

    org.jenkins-ci.main:jenkins-core Maven
    KEV Oct 2, 2025
  • Critical 9.8
    CVE-2015-7501 Exploited Public exploit Scanner template EPSS 86%

    Deserialization of Untrusted Data in Apache commons collections

    Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …

    org.apache.commons:commons-collections4 libcommons-collections3-java net.sourceforge.collections:collections-generic org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-12149 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter…

    Red Hat jbossas
    KEV Dec 10, 2021
  • Critical 9.8
    CVE-2017-3066 Exploited Public exploit EPSS 91%

    Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier ha…

    KEV Feb 24, 2025
  • Critical 9.8
    CVE-2015-7450 Exploited Public exploit Scanner template EPSS 98%

    Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and…

    KEV Jan 10, 2022
  • Critical 9.8
    CVE-2015-4852 Exploited Public exploit EPSS 95%

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…

    openjdk-8 libcommons-collections3-java Ubuntu
    KEV Nov 3, 2021