Deserialization of Untrusted Data (com.alibaba:fastjson)

CVE-2022-25845

HIGH 8.1

At a glance

Source: NVD
EPSS: EPSS 18.74 % · percentile 97 (2026-10-29)
State: PUBLISHED
Published: 2022-06-10 20:05 UTC
Updated: 2024-09-16 23:36 UTC
Assigner: snyk
NVD status: Modified

Search on…

Description

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Weaknesses (CWE)

CWE-502 — Deserialization of Untrusted Data

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P	snyk
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · report@snyk.io (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-pv7h-hx5h-mgfj — Unsafe deserialization in com.alibaba:fastjson

European references

ENISA EUVD · EUVD-2022-6120
GCVE · GCVE-0-2022-25845

Affected configurations (NVD CPE)

cpe:2.3:a:alibaba:fastjson:*:*:*:*:*:*:*:* < 1.2.83
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:*

Affected products

Product	Versions
com.alibaba:fastjson	affected unspecified < 1.2.83

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Deserialization of Untrusted Data (com.alibaba:fastjson)