Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
3,347 results · Feed
-
Critical 9.8
WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
-
Critical 9.8
WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
-
Critical 9.8
WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
-
Critical 9.8
WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
-
Critical 9.8
WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
-
Critical 9.8
WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
-
High 7.2
WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
-
Critical 9.8
WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
-
Critical 9.8
WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
-
Critical 9.8
WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
-
Critical 9.8
WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
-
Critical 9.8
WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
-
Critical 9.8
WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
-
Critical 9.8
WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
-
Critical 9.8
WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
-
Critical 9.8
WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
-
Critical 9.8
WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
-
Critical 9.8
WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
-
Critical 9.8
WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
-
Critical 9.8
WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
-
Critical 9.8
WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
-
High 8.8
WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
-
Critical 9.8
WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
-
Critical 9.8
WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
-
Critical 9.8
WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
-
Critical 9.8
WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
-
Critical 9.8
WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.
-
High 7.2
WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
-
High 7.2
WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
-
High 8.8
WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
-
Critical 9.8
WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
-
Critical 9.8
WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
-
Critical 9.8
WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
-
Critical 9.8
WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
-
Critical 9.8
WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
-
Critical 9.8
WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
-
Critical 9.8
WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
-
Critical 9.8
WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
-
Critical 9.8
WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
-
Critical 9.8
WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.