Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2022-1471: Achieving RCE on Android with SnakeYAML via Custom Gadget Chains — by Tino Preter Join us on Telegram: https://t.me/bugbountywizard https://medium.com/@tinopreter/cve-2022-1471-achieving-rce-on-android-with-snakeyaml-via-custom-gadget-chains-33e3eafed26c #bugbounty #bugbountytips #bugbountytip
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snakeyaml_project | snakeyaml | - | - | - |