9.8
CVE-2022-1471
- EPSS 93.85%
- Published 01.12.2022 11:15:10
- Last modified 18.06.2025 09:15:47
- Source cve-coordination@google.com
- Teams watchlist Login
- Open Login
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Data is provided by the National Vulnerability Database (NVD)
Snakeyaml Project ≫ Snakeyaml Version < 2.0
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 93.85% | 0.999 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| cve-coordination@google.com | 8.3 | 2.8 | 5.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.