漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Spring AMQP Deserialization Vulnerability
Vulnerability Description
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Vulnerability Type
N/A
Vulnerability Title
Spring AMQP 代码问题漏洞
Vulnerability Description
Spring AMQP是将核心 Spring 概念应用于基于 AMQP 的消息传递解决方案的开发。 Spring AMQP 1.0.0 到2.4.16 、 3.0.0 到 3.0.9版本存在安全漏洞，该漏洞源于Spring AMQP 中添加了可反序列化类名的允许列表模式，允许用户锁定来自不受信任来源的消息中数据的反序列化。
CVSS Information
N/A
Vulnerability Type
N/A