CyberRota Analysis
AI-GeneratedThe vulnerability arises from EAP's Artemis deserialization configuration, which allows deserialization of all classes by default due to empty allow-list and block-list settings. This can lead to remote code execution, as untrusted data can be deserialized without proper validation. Organizations using EAP should prioritize addressing this issue to mitigate potential exploitation risks.
Original NVD Description
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.