title: Deserialization of Untrusted Data
description: Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
product: Apache ShardingSphere-UI
vendor: Apache Software Foundation
versions:
changes: [at: 5.0.0, status: unaffected], lessThan: Apache ShardingSphere-UI*, status: affected, version: 4.1.1, versionType: custom
}
metrics:
other: [
content: {'other': 'low'}
type: unknown
]
workarounds: This issue is related to ShardingSphere-UI project. If you do not deploy UI project, it is not required to upgrade. Otherwise, the vulnerability issue of servers deployed UI project or version upgrade is supposed to consider.