CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-36050 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 12 | 8.0 | High | 2023-11-14 |
| CVE-2023-36439 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 8.0 | High | 2023-11-14 |
| CVE-2023-38177 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 6.1 | Medium | 2023-11-14 |
| CVE-2023-47248 | Apache Arrow 代码问题漏洞 — PyArrow | 9.8 | - | 2023-11-09 |
| CVE-2023-39913 | Apache UIMA 代码问题漏洞 — Apache UIMA Java SDK Core | 9.8 | - | 2023-11-08 |
| CVE-2023-1714 | Bitrix24 安全漏洞 — Bitrix24 | 8.8 | High | 2023-11-01 |
| CVE-2023-45672 | Frigate 代码问题漏洞 — frigate | 7.5 | High | 2023-10-30 |
| CVE-2023-5583 | WordPress Plugin WP Simple Galleries 代码问题漏洞 — WP Simple Galleries | 8.8 | High | 2023-10-30 |
| CVE-2023-46604 | Apache ActiveMQ 代码问题漏洞 — Apache ActiveMQ | 10.0 | Critical | 2023-10-27 |
| CVE-2023-4386 | WordPress plugin Essential Blocks 代码问题漏洞 — Essential Blocks Pro | 8.1 | High | 2023-10-20 |
| CVE-2022-3342 | WordPress Plugin Jetpack CRM 代码问题漏洞 — Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | 7.5 | High | 2023-10-20 |
| CVE-2023-4402 | WordPress plugin Essential Blocks 代码问题漏洞 — Essential Blocks Pro | 8.1 | High | 2023-10-20 |
| CVE-2023-35180 | SolarWinds Access Rights Manager 代码问题漏洞 — Access Rights Manager | 8.0 | High | 2023-10-19 |
| CVE-2023-35182 | SolarWinds Access Rights Manager 代码问题漏洞 — Access Rights Manager | 8.8 | High | 2023-10-19 |
| CVE-2023-35184 | SolarWinds Access Rights Manager 代码问题漏洞 — Access Rights Manager | 8.8 | High | 2023-10-19 |
| CVE-2023-35186 | SolarWinds Access Rights Manager 代码问题漏洞 — Access Rights Manager | 8.0 | High | 2023-10-19 |
| CVE-2023-46227 | Apache InLong 代码问题漏洞 — Apache InLong | 9.8 | - | 2023-10-19 |
| CVE-2023-45146 | XXL-RPC 代码问题漏洞 — xxl-rpc | 9.1 | Critical | 2023-10-18 |
| CVE-2023-23930 | vantage6 代码问题漏洞 — vantage6 | 5.5 | Medium | 2023-10-11 |
| CVE-2023-42809 | Redisson 代码问题漏洞 — redisson | 9.7 | Critical | 2023-10-04 |
| CVE-2023-5391 | Schneider Electric EcoStruxure Power Monitoring Expert 代码问题漏洞 — EcoStruxure Power Monitoring Expert | 9.8 | Critical | 2023-10-04 |
| CVE-2023-39410 | Apache Avro 代码问题漏洞 — Apache Avro Java SDK | 7.5 | - | 2023-09-29 |
| CVE-2023-40044 | WS_FTP Server 代码问题漏洞 — WS_FTP Server | 10.0 | Critical | 2023-09-27 |
| CVE-2023-5183 | Illumio PCE 代码问题漏洞 — Core PCE | 9.9 | Critical | 2023-09-26 |
| CVE-2023-5016 | spider-flow 代码问题漏洞 — spider-flow | 6.3 | Medium | 2023-09-17 |
| CVE-2023-38204 | Adobe ColdFusion 代码问题漏洞 — ColdFusion | 9.8 | Critical | 2023-09-14 |
| CVE-2023-36777 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 12 | 5.7 | Medium | 2023-09-12 |
| CVE-2023-38155 | Microsoft Azure DevOps Server 安全漏洞 — Azure DevOps Server 2019.0.1 | 7.0 | High | 2023-09-12 |
| CVE-2023-36736 | Microsoft Identity Linux Broker 安全漏洞 — Microsoft Identity Linux Broker | 4.4 | Medium | 2023-09-12 |
| CVE-2023-36745 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 13 | 8.0 | High | 2023-09-12 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。