Vulnerability Description
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Decision Manager | 7.0 |
| Redhat | Drools | 7.69.0 |
| Redhat | Jboss Middleware Text-Only Advisories | - |
| Redhat | Process Automation | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2022:6813Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1415Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2065505Issue TrackingVendor Advisory
- https://access.redhat.com/errata/RHSA-2022:6813Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1415Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2065505Issue TrackingVendor Advisory
FAQ
What is CVE-2022-1415?
CVE-2022-1415 is a vulnerability with a CVSS score of 8.1 (HIGH). A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (...
How severe is CVE-2022-1415?
CVE-2022-1415 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-1415?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Decision Manager, Redhat Drools, Redhat Jboss Middleware Text-Only Advisories, Redhat Process Automation.