9.8crit
CVE-2020-36282
Unsafe Deserialization that can Result in Code Execution
Also known as GHSA-v525-c3g5-cg9p
Published 5 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
2.8%
percentile 87%
Public exploits
0
none known
Summary
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Exploit prediction (EPSS)
2.84% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.rabbitmq.jms:rabbitmq-jms | >=2.0, <2.2.0 >=1.0, <1.15.2 | 2.2.0 1.15.2 |
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
References
- medium.com /%40ramon93i7/a99645d0448b · x_refsource_MISC, x_transferred
- github.com /rabbitmq/rabbitmq-jms-client/issues/135 · x_refsource_MISC, x_transferred
- github.com /rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2 · x_refsource_MISC, x_transferred
- github.com /rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2020-36282 · advisory
- github.com /rabbitmq/rabbitmq-jms-client/pull/136/commits/f647e5dbfe055a2ca8cbb16dd70f9d50d888b638 · web
- medium.com /@ramon93i7/a99645d0448b · web
Sources
- CVE List: CVE-2020-36282
- GitHub Advisory: GHSA-v525-c3g5-cg9p
- NVD: CVE-2020-36282
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.