CVE-2022-1471

Aliases:GHSA-mjmj-j48q-9wg2
Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 01 Dec 2022, 10:47
Last modified:18 Jun 2025, 08:32

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
93.85% CRITICAL
94% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

01 Dec 2022, 10:47
Published
Vulnerability first disclosed
18 Jun 2025, 08:32
Last Modified
Vulnerability information updated

Description

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

CVSS Metrics

  • v3.1•HIGH•Score: 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 93.85%• Percentile: 100%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • org.yaml•snakeyaml

    < 2.0

  • snakeyaml_project•snakeyaml

    < 2.0

  • snakeyaml•snakeyaml

    ≤ 2.0

References (21)