CAPEC-586
Benachrichtigung für ein CAPEC
Bleiben Sie über alle Änderungen zu einem bestimmten CAPEC informiert.
CAPEC-Beschreibungen
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
CAPEC-Informationen
Voraussetzungen
The target application must unserialize data before validation.Gegenmaßnahmen
Verwandte Schwachstellen
| Name der Schwachstelle | |
|---|---|
CWE-502 |
Deserialization of Untrusted Data The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Referenzen
REF-468
Deserialization of Untrusted DataEinreichung
| Name | Organisation | Datum | Veröffentlichungsdatum |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Änderungen
| Name | Organisation | Datum | Kommentar |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated References, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Mitigations | |
| CAPEC Content Team | The MITRE Corporation | Updated Mitigations |
