Deserialization in VMware Spring Framework
CVE-2016-1000027
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Vulnerability class: Insecure Deserialization
EPSS: 0.323 (98.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Vmware Spring_framework
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
- artem-smotrakov/cve-2016-1000027-poc
- tina94happy/Spring-Web-5xx-Mitigated-version
- Ragatzino/test-cve-2016-1000027
- yihtserns/spring-web-without-remoting
- ARPSyndicate/cvemon
- Challengers-win/Sec-Interview-ai
- IkerSaint/VULNAPP-vulnerable-app
- Live-Hack-CVE/CVE-2016-1000
- Live-Hack-CVE/CVE-2016-1000027
- NicheToolkit/rest-toolkit
References
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Exploit, Third Party Advisory, Broken Link)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (Third Party Advisory, Issue Tracking)
- cve@mitre.org (Third Party Advisory, Issue Tracking)
- cve@mitre.org (Third Party Advisory, Issue Tracking)
- cve@mitre.org (Third Party Advisory, Release Notes)
- cve@mitre.org (Third Party Advisory, Issue Tracking)
- cve@mitre.org
Frequently asked questions
- What is CVE-2016-1000027?
- CVE-2016-1000027 is a critical-severity vulnerability in VMware Spring Framework, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2020-01-02.
- How severe is CVE-2016-1000027?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2016-1000027 known to be exploited?
- 33 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.