CVSS: 9.0EPSS: 1%CPEs: 4EXPL: 0CVE-2022-1415 – Drools: unsafe data deserialization in streamutils
https://notcve.org/view.php?id=CVE-2022-1415
11 Sep 2023 — A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. Se encontró una falla en la que algunas clases de utilidad en el núcleo de Drools no usaban las medidas de seguridad adecuadas al deserializar datos. Esta falla permite a un atacante autenticado construir objetos serializados maliciosos (generalm... • https://access.redhat.com/errata/RHSA-2022:6813 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41411
https://notcve.org/view.php?id=CVE-2021-41411
16 Jun 2022 — drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability. drools versiones anteriores a7.59.x incluyéndola, está afectado por una vulnerabilidad de tipo XML External Entity (XXE) en KieModuleMarshaller.java. La clase Validator no es usada correctamente, resultando en una vulnerabilidad de inyección XXE • https://github.com/kiegroup/drools/pull/3808 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-7041 – Workbench: Path traversal vulnerability
https://notcve.org/view.php?id=CVE-2016-7041
29 Nov 2016 — Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. Drools Workbench contiene una vulnerabilidad de salto de directorio. La vulnerabilidad permite que un atacante autenticado remoto omita las restricciones del directorio y recupere archivos arbitrarios desde el host afectado Drools Workbench contains the path traversal vulnerability. The vulnerability allo... • http://rhn.redhat.com/errata/RHSA-2016-2822.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-8125 – jBPM: BPMN2 file processing XXE in Process Execution
https://notcve.org/view.php?id=CVE-2014-8125
17 Apr 2015 — XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file. Vulnerabilidad de entidad externa XML (XXE) en Drools and jBPM anterior a 6.2.0 permite a atacantes remotos leer ficheros arbitrarios o posiblemente tener otro impacto no especificado a través de un fichero BPMN2 manipulado. It was discovered that the jBPM runtime performed expansion of external parameter entities while ex... • http://rhn.redhat.com/errata/RHSA-2015-0850.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2013-6468 – Drools: Remote Java Code Execution in MVEL
https://notcve.org/view.php?id=CVE-2013-6468
03 Apr 2014 — JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression. JBoss Drools, Red Hat JBoss BRMS anterior a 6.0.1 y Red Hat JBoss BPM Suite anterior a 6.0.1 permite a usuarios remotos autenticados ejecutar código Java arbitrario a través de una expresión (1) MVFLEX Expression Language (MVEL) o (2) Drools Red Hat JBoss BPM Suite is a business rules man... • http://rhn.redhat.com/errata/RHSA-2014-0371.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •