PT-2018-9931

CVE-2018-1051

Publicado

2018-01-25

Atualizado

2022-05-13

Descrição por

CVSS 3.1

8.1

Alta

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Resteasy versions 3.0.22 and 3.1.2

Description: The issue is related to incomplete fixing of a previous problem in Yaml unmarshalling within Resteasy, allowing it to still occur via Yaml.load() in YamlProvider.

Recommendations: For versions 3.0.22 and 3.1.2, if the YamlProvider is enabled, add authentication and authorization to the endpoint expecting Yaml content to prevent exploitation of this issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Adam Mariš

Rui Chong

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-502: Deserialization of Untrusted Data

CWE-20: Improper Input Validation

Identificadores relacionados