Vulnerabilities > CVE-2020-8441 - Deserialization of Untrusted Data vulnerability in Jyaml Project Jyaml
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 7 |
Common Weakness Enumeration (CWE)
References
- https://gist.github.com/j0lt-github/f5141abcacae63d434ecae211422153a
- https://gist.github.com/j0lt-github/f5141abcacae63d434ecae211422153a
- https://github.com/mbechler/marshalsec
- https://github.com/mbechler/marshalsec
- https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
- https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
- https://security.netapp.com/advisory/ntap-20200313-0001/
- https://security.netapp.com/advisory/ntap-20200313-0001/
- https://sourceforge.net/p/jyaml/bugs/
- https://sourceforge.net/p/jyaml/bugs/