Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
3,342 results · Feed
-
Critical 9.8
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
-
Critical 9.8
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
-
Critical 9.8
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
-
Critical 9.8
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
-
Critical 9.8
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
-
Critical 9.8
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
-
Critical 9.8
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
-
Critical 9.8
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
-
Critical 9.8
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
-
Critical 9.8
WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
-
Critical 9.8
WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
-
Critical 9.8
WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
-
Critical 9.8
WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
-
Critical 9.8
WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
-
Critical 9.8
WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
-
Critical 9.8
WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
-
Critical 9.8
WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
-
Critical 9.8
WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
-
Critical 9.8
WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
-
Critical 9.8
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
-
Critical 9.8
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
-
Critical 9.8
WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
-
Critical 9.8
WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
-
Critical 9.8
WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
-
Critical 9.8
WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
-
High 7.2
WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
-
High 8.1
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
-
High 8.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
-
Critical 9.0
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP o…
-
High 7.8
Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability
Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit t…
-
High 7.8
Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability
Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerabi…
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objec…
-
Medium 5.4
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, a…
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by t…
-
High 7.2
WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a throu…
-
Critical 9.8
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
-
High 8.8
WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
-
High 7.2
WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
-
High 7.2
WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
-
High 8.8
WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.