Loading
Generated remediation guidance and an executive summary. No account required.
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Use CWE-20, Snakeyaml Project vendor hub and Snakeyaml product page to widen CVE-2022-1471 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2022-25857, CVE-2017-18640 and CVE-2022-38752 for nearby disclosures in the same product family.