CyberRota Analysis
AI-GeneratedSpring Integration's JSON to object conversion process is vulnerable due to improper handling of the json__TypeId__ header, allowing attackers to manipulate the deserialization target type without a type/package allow-list. This could lead to remote code execution or other malicious activities if exploited. Organizations using affected versions of Spring Integration should prioritize patching to mitigate potential risks associated with this vulnerability.
Original NVD Description
Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)