VulnerabilityModified
CVE-2022-1415
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data.
HIGH 8.8EPSS 1.04%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.04%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.04% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- redhat/decision manager · redhat/drools · redhat/jboss middleware text-only advisories · redhat/process automation
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2022:6813Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1415Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2065505Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2022:6813Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1415Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2065505Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.