Vulnerability · Published Nov 11, 2021 · Assigned by apache
CVE-2021-26558Deserialization of Untrusted Data
High 7.5
In plain English
A high-severity unsafe deserialization in Apache ShardingSphere-UI from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ShardingSphere-UI | 4.1.1 – before Apache ShardingSphere-UI* |
Weakness: CWE-502
References
- https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c x_refsource_MISC
- [oss-security] 20211111 CVE-2021-26558: Apache ShardingSphere-UI: Deserialization of Untrusted Data mailing-list, x_refsource_MLIST