CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-29216 | Apache Linkis 代码问题漏洞 — Apache Linkis | 9.8 | - | 2023-04-10 |
| CVE-2023-29215 | Apache Linkis 代码问题漏洞 — Apache Linkis | 9.8 | - | 2023-04-10 |
| CVE-2023-29006 | GLPI 代码问题漏洞 — order | 8.8 | High | 2023-04-05 |
| CVE-2023-20102 | Cisco Secure Network Analytics 代码问题漏洞 — Cisco Secure Network Analytics | 8.8 | High | 2023-04-05 |
| CVE-2022-2561 | OPC Labs QuickOPC 代码问题漏洞 — QuickOPC | 7.8 | - | 2023-03-29 |
| CVE-2022-28685 | AVEVA Edge 代码问题漏洞 — Edge | 7.8 | - | 2023-03-29 |
| CVE-2022-36971 | Ivanti Avalanche 代码问题漏洞 — Avalanche | 9.8 | - | 2023-03-29 |
| CVE-2022-36974 | Ivanti Avalanche 代码问题漏洞 — Avalanche | 9.8 | - | 2023-03-29 |
| CVE-2022-36977 | Ivanti Avalanche 代码问题漏洞 — Avalanche | 9.8 | - | 2023-03-29 |
| CVE-2022-36978 | Ivanti Avalanche 代码问题漏洞 — Avalanche | 9.8 | - | 2023-03-29 |
| CVE-2023-1399 | Keysight Technologies N6854A Geolocation server 代码问题漏洞 — N6854A Geolocation Server | 7.8 | High | 2023-03-27 |
| CVE-2023-1145 | Delta Electronics InfraSuite Device Master 代码问题漏洞 — InfraSuite Device Master | 7.8 | High | 2023-03-27 |
| CVE-2023-27296 | Apache InLong 代码问题漏洞 — Apache InLong | 8.8 | - | 2023-03-27 |
| CVE-2023-26359 | Adobe ColdFusion 代码问题漏洞 — ColdFusion | 9.8 | Critical | 2023-03-23 |
| CVE-2023-27978 | Schneider Electric IGSS Data Server代码问题漏洞 — IGSS Data Server(IGSSdataServer.exe) | 7.8 | High | 2023-03-21 |
| CVE-2023-28115 | Snappy 代码问题漏洞 — snappy | 9.8 | Critical | 2023-03-17 |
| CVE-2023-26464 | Apache Log4j 代码问题漏洞 — Apache Log4j | 7.5 | - | 2023-03-10 |
| CVE-2023-23638 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 5.0 | Medium | 2023-03-08 |
| CVE-2022-23535 | LiteDB 代码问题漏洞 — LiteDB | 7.3 | High | 2023-02-24 |
| CVE-2023-0960 | SeaCMS 代码问题漏洞 — SeaCMS | 4.7 | Medium | 2023-02-22 |
| CVE-2022-48282 | MongoDB 代码问题漏洞 — MongoDB .NET/C# Driver | 6.6 | Medium | 2023-02-21 |
| CVE-2022-47986 | IBM Aspera Faspex 代码问题漏洞 — Aspera Faspex | 9.8 | Critical | 2023-02-17 |
| CVE-2022-38111 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2023-02-15 |
| CVE-2022-47503 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2023-02-15 |
| CVE-2022-47504 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2023-02-15 |
| CVE-2022-47507 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2023-02-15 |
| CVE-2023-23836 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2023-02-15 |
| CVE-2023-21713 | Microsoft SQL Server 安全漏洞 — Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) | 8.8 | High | 2023-02-14 |
| CVE-2023-21710 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 7.2 | High | 2023-02-14 |
| CVE-2023-21703 | Microsoft Azure Data Box Gateway 安全漏洞 — Azure Data Box Gateway | 6.5 | Medium | 2023-02-14 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。