CVE-2022-1471

Published Dec 1, 2022

Last updated 5 months ago

CVSS critical 9.8

Overview

Description: SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Source: cve-coordination@google.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-502
cve-coordination@google.com: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3598DC3A-DDD1-4A0B-ACDA-406B85A1EA1A",
            "versionEndExcluding": "2.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References