CVE-2021-22097

Katalog CVE

CVSS 6.5 · Medium EPSS 1,1%

Kerentanan Deserialization of Untrusted Data pada vmware spring advanced message queuing protocol. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

Rincian

Terbit di NVD

28 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://tanzu.vmware.com/security/cve-2021-22097 advisory vendor