Vulnerability Description
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alibaba | Fastjson | < 1.2.83 |
| Oracle | Communications Cloud Native Core Unified Data Repository | 22.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920aPatchThird Party Advisory
- https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301PatchThird Party Advisory
- https://github.com/alibaba/fastjson/releases/tag/1.2.83Release NotesThird Party Advisory
- https://github.com/alibaba/fastjson/wiki/security_update_20220523Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222Third Party Advisory
- https://www.ddosi.org/fastjson-poc/ExploitThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
- https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920aPatchThird Party Advisory
- https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301PatchThird Party Advisory
- https://github.com/alibaba/fastjson/releases/tag/1.2.83Release NotesThird Party Advisory
- https://github.com/alibaba/fastjson/wiki/security_update_20220523Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222Third Party Advisory
- https://www.ddosi.org/fastjson-poc/ExploitThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2022-25845?
CVE-2022-25845 is a vulnerability with a CVSS score of 8.1 (HIGH). The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. ...
How severe is CVE-2022-25845?
CVE-2022-25845 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-25845?
Check the references section above for vendor advisories and patch information. Affected products include: Alibaba Fastjson, Oracle Communications Cloud Native Core Unified Data Repository.