// For flags

CVE-2022-1415

Drools: unsafe data deserialization in streamutils

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

Se encontró una falla en la que algunas clases de utilidad en el núcleo de Drools no usaban las medidas de seguridad adecuadas al deserializar datos. Esta falla permite a un atacante autenticado construir objetos serializados maliciosos (generalmente llamados gadgets) y lograr la ejecución de código en el servidor.

*Credits: Red Hat would like to thank Paulino Calderon (Websec) for reporting this issue.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2022-04-20 CVE Reserved
  • 2023-09-11 CVE Published
  • 2024-09-17 EPSS Updated
  • 2024-09-25 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Decision Manager
Search vendor "Redhat" for product "Decision Manager"
 7.0
Search vendor "Redhat" for product "Decision Manager" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
 Drools
Search vendor "Redhat" for product "Drools"
 7.69.0
Search vendor "Redhat" for product "Drools" and version "7.69.0"
-
Affected
Redhat
Search vendor "Redhat"
 Jboss Middleware Text-only Advisories
Search vendor "Redhat" for product "Jboss Middleware Text-only Advisories"
--
Affected
Redhat
Search vendor "Redhat"
 Process Automation
Search vendor "Redhat" for product "Process Automation"
 7.0
Search vendor "Redhat" for product "Process Automation" and version "7.0"
-
Affected