CVE-2020-5413
published 2020-07-31CVE-2020-5413: Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options…
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.41%
90.2th percentile
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | retail_customer_management_and_segmentation_foundation | 16.0 – 19.0 | — |
| oracle | retail_merchandising_system | — | — |
| spring_by_vmware | spring_integration | >= 4.3 < v4.3.23.RELEASE | v4.3.23.RELEASE |
| spring_by_vmware | spring_integration | >= 5.1 < v5.1.12.RELEASE | v5.1.12.RELEASE |
| spring_by_vmware | spring_integration | >= 5.2 < v5.2.8.RELEASE | v5.2.8.RELEASE |
| spring_by_vmware | spring_integration | >= 5.3 < v5.3.2.RELEASE | v5.3.2.RELEASE |
| vmware | spring_integration | 4.3.0 – 4.3.22 | — |
| vmware | spring_integration | 5.1.0 – 5.1.11 | — |
| vmware | spring_integration | 5.2.0 – 5.2.7 | — |
| vmware | spring_integration | 5.3.0 – 5.3.1 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_oracle9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Code execution in Spring Integration
ghsa·2020-08-05
CVE-2020-5413 [CRITICAL] CWE-502 Code execution in Spring Integration
Code execution in Spring Integration
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
OSV
Code execution in Spring Integration
osv·2020-08-05
CVE-2020-5413 [CRITICAL] Code execution in Spring Integration
Code execution in Spring Integration
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Loans (Spring Integration) — CVE-2020-5413
vendor_oracle·2021-10-15·CVSS 9.8
CVE-2020-5413 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Loans (Spring Integration) — CVE-2020-5413
Oracle Oracle Financial Services Applications Risk Matrix: Loans (Spring Integration) vulnerability
CVE: CVE-2020-5413
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Spring Integration) — CVE-2020-5413
vendor_oracle·2021-07-15·CVSS 9.8
CVE-2020-5413 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Spring Integration) — CVE-2020-5413
Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Spring Integration) vulnerability
CVE: CVE-2020-5413
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Order Management (Spring Integration) — CVE-2020-5413
vendor_oracle·2021-04-15·CVSS 9.8
CVE-2020-5413 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Order Management (Spring Integration) — CVE-2020-5413
Oracle Oracle Financial Services Applications Risk Matrix: Order Management (Spring Integration) vulnerability
CVE: CVE-2020-5413
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://tanzu.vmware.com/security/cve-2020-5413https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://tanzu.vmware.com/security/cve-2020-5413https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2020-07-31
Published