CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-21529 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2013 Cumulative Update 23 | 8.8 | High | 2023-02-14 |
| CVE-2023-21568 | Microsoft SQL Server 安全漏洞 — SQL Server Integration Services for Visual Studio 2019 | 7.3 | High | 2023-02-14 |
| CVE-2023-21707 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2013 Cumulative Update 23 | 8.8 | High | 2023-02-14 |
| CVE-2023-21706 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2013 Cumulative Update 23 | 8.8 | High | 2023-02-14 |
| CVE-2023-25558 | DataHub 代码问题漏洞 — datahub | 7.5 | High | 2023-02-10 |
| CVE-2022-3568 | WordPress plugin ImageMagick Engine 跨站请求伪造漏洞 — ImageMagick Engine | 8.8 | High | 2023-02-09 |
| CVE-2023-25194 | Apache Kafka 代码问题漏洞 — Apache Kafka Connect API | 8.8 | - | 2023-02-07 |
| CVE-2023-0669 | HelpSystems GoAnywhere MFT 代码问题漏洞 — Goanywhere MFT | 8.8 | - | 2023-02-06 |
| CVE-2023-24997 | Apache InLong 代码问题漏洞 — Apache InLong | 9.8 | - | 2023-02-01 |
| CVE-2022-44645 | Apache Linkis 代码问题漏洞 — Apache Linkis (incubating) | 8.8 | - | 2023-01-31 |
| CVE-2022-32521 | Schneider Electric StruxureWare Data Center Expert 代码问题漏洞 — Data Center Expert | 7.1 | High | 2023-01-30 |
| CVE-2022-4890 | PredictApp 代码问题漏洞 — PredictApp | 6.3 | Medium | 2023-01-16 |
| CVE-2022-41778 | Delta Electronics InfraSuite Device Master 代码问题漏洞 — InfraSuite Device Master | 9.8 | Critical | 2023-01-12 |
| CVE-2023-21779 | Microsoft Visual Studio Code 安全漏洞 — Visual Studio Code | 7.8 | High | 2023-01-10 |
| CVE-2023-21762 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 8.0 | High | 2023-01-10 |
| CVE-2023-21745 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 8.0 | High | 2023-01-10 |
| CVE-2023-21744 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 8.8 | High | 2023-01-10 |
| CVE-2023-21538 | Microsoft .NET 安全漏洞 — .NET 6.0 | 7.5 | High | 2023-01-10 |
| CVE-2021-32828 | Nuxeo 跨站脚本漏洞 — Nuxeo | 5.4 | Medium | 2023-01-05 |
| CVE-2021-32824 | Apache Dubbo 代码问题漏洞 — Dubbo | 9.8 | Critical | 2023-01-03 |
| CVE-2022-32224 | Rails 代码问题漏洞 — https://github.com/rails/rails | 9.8 | - | 2022-12-05 |
| CVE-2022-46366 | Apache Tapestry 代码问题漏洞 — Apache Tapestry | 9.8 | - | 2022-12-02 |
| CVE-2022-36964 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 8.8 | High | 2022-11-29 |
| CVE-2022-41958 | Super Xray 代码问题漏洞 — super-xray | 7.3 | High | 2022-11-25 |
| CVE-2022-41875 | Optica 代码问题漏洞 — optica | 10.0 | Critical | 2022-11-23 |
| CVE-2022-41922 | Yii 代码问题漏洞 — yii | 8.1 | High | 2022-11-23 |
| CVE-2022-3861 | WordPress theme Betheme 代码问题漏洞 — Betheme | 8.8 | High | 2022-11-21 |
| CVE-2022-3525 | LibreNMS 代码问题漏洞 — librenms/librenms | 9.8 | - | 2022-11-20 |
| CVE-2022-45047 | Apache MINA 代码问题漏洞 — Apache MINA SSHD | 9.8 | - | 2022-11-16 |
| CVE-2022-45136 | Apache Jena 代码问题漏洞 — Apache Jena SDB | 9.8 | - | 2022-11-14 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。