CVE-2022-25845

Fixed upstream EPSS 19%CVSS 8.1

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Published 2022-06-10 · CVE record · OSV

Products: alibaba fastjson, oracle communications_cloud_native_core_unified_data_repository

Fixed upstream