CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-41203 | SAP BusinessObjects BI Platform 代码问题漏洞 — SAP BusinessObjects Business Intelligence Platform (Central Management Console and BI Launchpad) | 8.8 | - | 2022-11-08 |
| CVE-2022-3536 | WordPress plugin Role Based Pricing for WooCommerce 代码问题漏洞 — Role Based Pricing for WooCommerce | 8.8 | - | 2022-11-07 |
| CVE-2022-43567 | Splunk 代码问题漏洞 — Splunk Enterprise | 8.8 | High | 2022-11-04 |
| CVE-2022-39379 | Fluentd 代码问题漏洞 — fluentd | 3.1 | Low | 2022-11-02 |
| CVE-2022-41779 | Delta Electronics InfraSuite Device Master 代码问题漏洞 — InfraSuite Device Master | 8.8 | High | 2022-10-31 |
| CVE-2022-38142 | Delta Electronics InfraSuite Device Master 代码问题漏洞 — InfraSuite Device Master | 9.8 | Critical | 2022-10-31 |
| CVE-2022-3334 | WordPress plugin Easy WP SMTP 代码问题漏洞 — Easy WP SMTP | 7.2 | - | 2022-10-31 |
| CVE-2022-3357 | WordPress plugin Smart Slider 代码问题漏洞 — Smart Slider 3 | 9.8 | - | 2022-10-31 |
| CVE-2022-3360 | WordPress plugin LearnPress 代码问题漏洞 — LearnPress – WordPress LMS Plugin | 8.1 | - | 2022-10-31 |
| CVE-2022-3366 | WordPress plugin PublishPress Capabilities 代码问题漏洞 — PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus | 7.2 | - | 2022-10-31 |
| CVE-2022-3374 | WordPress plugin Ocean Extra 代码问题漏洞 — Ocean Extra | 7.2 | - | 2022-10-31 |
| CVE-2022-3380 | WordPress plugin Customizer Export/Import 代码问题漏洞 — Customizer Export/Import | 7.2 | - | 2022-10-31 |
| CVE-2022-40238 | CERT Coordination Center VINCE代码问题漏洞 — VINCE - The Vulnerability Information and Coordination Environment | 8.0 | - | 2022-10-26 |
| CVE-2022-3335 | WordPress plugin Kadence WooCommerce Email Designer 代码问题漏洞 — Kadence WooCommerce Email Designer | 7.2 | - | 2022-10-25 |
| CVE-2022-38108 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2022-10-20 |
| CVE-2022-36958 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 8.8 | High | 2022-10-20 |
| CVE-2022-36957 | SolarWinds Platform 代码问题漏洞 — SolarWinds Platform | 7.2 | High | 2022-10-20 |
| CVE-2022-23734 | GitHub Enterprise Server 代码问题漏洞 — GitHub Enterprise Server | 8.8 | - | 2022-10-19 |
| CVE-2022-39198 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 9.8 | - | 2022-10-18 |
| CVE-2022-39311 | GoCD 代码问题漏洞 — gocd | 9.1 | Critical | 2022-10-14 |
| CVE-2022-39297 | Melis Platform 代码问题漏洞 — melis-cms | 7.7 | High | 2022-10-12 |
| CVE-2022-39298 | Media Links routers 代码问题漏洞 — melis-front | 7.7 | High | 2022-10-12 |
| CVE-2022-39256 | Orckestra C1 CMS 代码问题漏洞 — C1-CMS-Foundation | 9.0 | Critical | 2022-09-27 |
| CVE-2022-2903 | WordPress plugin Ninja Forms Contact Form 代码问题漏洞 — Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress | 7.2 | - | 2022-09-26 |
| CVE-2022-40955 | Apache InLong 代码问题漏洞 — Apache InLong | 8.8 | - | 2022-09-20 |
| CVE-2022-36038 | CircuitVerse 代码问题漏洞 — CircuitVerse | 8.8 | High | 2022-09-06 |
| CVE-2022-2434 | WordPress plugin String Locator 代码问题漏洞 — String locator | 8.8 | High | 2022-09-06 |
| CVE-2022-2436 | WordPress plugin Download Manager 代码问题漏洞 — Download Manager | 8.8 | High | 2022-09-06 |
| CVE-2022-2438 | WordPress plugin Broken Link Checker 代码问题漏洞 — Broken Link Checker | 7.2 | High | 2022-09-06 |
| CVE-2022-2442 | WordPress plugin Migration, Backup, Staging – WPvivid 代码问题漏洞 — WPvivid — Backup, Migration & Staging | 7.2 | High | 2022-09-06 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。