JFinal Java Deserialization Vulnerability

2022-05-2419:06:05

Google

osv.dev

0.008 Low

EPSS

Percentile

81.4%

JSON

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis which can lead to remote code execution

CPENameOperatorVersion
com.jfinal:jfinaleq4.9.02
com.jfinal:jfinaleq3.6
com.jfinal:jfinaleq1.4
com.jfinal:jfinaleq4.9.08
com.jfinal:jfinaleq4.4
com.jfinal:jfinaleq4.5
com.jfinal:jfinaleq4.9.04
com.jfinal:jfinaleq1.4.0
com.jfinal:jfinaleq4.9.05
com.jfinal:jfinaleq1.9

Name	Operator	Version
com.jfinal:jfinal	eq	4.9.02
com.jfinal:jfinal	eq	3.6
com.jfinal:jfinal	eq	1.4
com.jfinal:jfinal	eq	4.9.08
com.jfinal:jfinal	eq	4.4
com.jfinal:jfinal	eq	4.5
com.jfinal:jfinal	eq	4.9.04
com.jfinal:jfinal	eq	1.4.0
com.jfinal:jfinal	eq	4.9.05
com.jfinal:jfinal	eq	1.9