CVE-2022-1415
Last modified
CVE-2022-1415 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.. EPSS estimates a 1.05% chance of exploitation in the next 30 days.
Description
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Decision Manager | 7.0 |
| Redhat | Drools | 7.69.0 |
| Redhat | Jboss Middleware Text-Only Advisories | All versions |
| Redhat | Process Automation | 7.0 |
References
- https://access.redhat.com/errata/RHSA-2022:6813Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1415Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2065505Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2022:6813Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1415Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2065505Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1415?
How severe is CVE-2022-1415?
How do I fix CVE-2022-1415?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1409The VikBooking Hotel Booking Engine & PMS WordPress plugin b…7.2
- CVE-2022-1410OS Command Injection vulnerability in the db_optimize compon…8.8
- CVE-2022-1411Unrestructed file upload in GitHub repository yetiforcecompa…6.1
- CVE-2022-1412The Log WP_Mail WordPress plugin through 0.1 saves sent emai…7.5
- CVE-2022-1413Missing input masking in GitLab CE/EE affecting all versions…7.5
- CVE-2022-14143scale API Management 2 does not perform adequate sanitation…8.8
- CVE-2022-1416Missing sanitization of data in Pipeline error messages in G…5.4
- CVE-2022-1417Improper access control in GitLab CE/EE affecting all versio…4.3
- CVE-2022-1418The Social Stickers WordPress plugin through 2.2.9 does not …6.1
- CVE-2022-1419The root cause of this vulnerability is that the ioctl$DRM_I…7.8
- CVE-2022-1420Use of Out-of-range Pointer Offset in GitHub repository vim/…5.5
- CVE-2022-1421The Discy WordPress theme before 5.2 lacks CSRF checks in so…4.3
Are you affected by CVE-2022-1415?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST