CVE-2016-1000027

Katalog CVE

CVSS 9.8 · Critical EPSS 33,2%

Kerentanan Deserialization of Untrusted Data pada vmware spring framework. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Rincian

Terbit di NVD

2 Januari 2020

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

33,2% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027 issue tracking · advisory pihak ketiga
• https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626 issue tracking · advisory pihak ketiga
• https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417 issue tracking · advisory pihak ketiga
• https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525 issue tracking · advisory pihak ketiga
• https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json broken link · exploit · advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2016-1000027 advisory pihak ketiga
• https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now release notes · advisory pihak ketiga
• https://www.tenable.com/security/research/tra-2016-20 exploit · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230420-0009/