CVE-2022-1415 HIGH

CVE-2022-1415: Drools: unsafe data deserialization in streamutils

Vendor Red Hat
Product RHPAM 7.13.1 async
Weakness CWE-502 · Unsafe deserialization
Published September 11, 2023
Last update September 25, 2024

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

Key dates

02Disclosure timeline

September 11, 2023 CVE published
September 25, 2024 Record updated

Related vulnerabilities

04Related CVE