CVE-2021-32836

Name of the Vulnerable Software and Affected Versions ZStack versions prior to 3.10.12 ZStack versions prior to 4.1.6

Description The issue is related to a pre-auth unsafe deserialization vulnerability in the REST API. An attacker controlling the request body can provide the class name and data to be deserialized, allowing instantiation of an arbitrary type and assignment of arbitrary values to its fields. This may lead to a Denial Of Service. If a suitable gadget is available, an attacker may also be able to exploit this vulnerability to gain pre-auth remote code execution.

Recommendations For versions prior to 3.10.12, update to version 3.10.12 or later. For versions prior to 4.1.6, update to version 4.1.6 or later.