CVE-2016-1000027 Security Details

CVE ID

CVE-2016-1000027

CWE

CWE-502

CVE Description

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Published

Jan 7, 2020

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

60.417%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.readRemoteInvocation(Ljavax/servlet/http/HttpServletRequest;)Lorg/springframework/remoting/support/RemoteInvocation;

JVMVulnerable params: 0

org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.readRemoteInvocation(Ljavax/servlet/http/HttpServletRequest;Ljava/io/InputStream;)Lorg/springframework/remoting/support/RemoteInvocation;

JVMVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Issue #24434PROJECT

gypsyengineer.comTHIRD_PARTY

Red Hat · BugzillaTHIRD_PARTY

tenable.comTHIRD_PARTY