1209
Nature Type ID Name Page
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Maintenance
The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more
narrowly scoped to object modification, and is not necessarily used for deserialization.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Deserialization of untrusted data
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER01-J Do not deviate from the proper
signatures of serialization methods
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER03-J Do not serialize unencrypted, sensitive
data
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER06-J Make defensive copies of private
mutable components during
deserialization
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER08-J Do not use the default serialized form
for implementation defined invariants
Software Fault Patterns SFP25 Tainted input to variable
Related Attack Patterns
CAPEC-ID Attack Pattern Name
586 Object Injection
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-461]Matthias Kaiser. "Exploiting Deserialization Vulnerabilities in Java". 2015 October 8. <
https://www.slideshare.net/codewhitesec/exploiting-deserialization-vulnerabilities-in-java-54707478
>.2023-04-07.
[REF-462]Sam Thomas. "PHP unserialization vulnerabilities: What are we missing?". 2015 August
7. < https://www.slideshare.net/_s_n_t/php-unserialization-vulnerabilities-what-are-we-missing
>.2023-04-07.
[REF-463]Gabriel Lawrence and Chris Frohoff. "Marshalling Pickles: How deserializing objects can
ruin your day". 2015 January 8. < https://www.slideshare.net/frohoff1/appseccali-2015-marshallingpickles
>.2023-04-07.
[REF-464]Heine Deelstra. "Unserializing user-supplied data, a bad idea". 2010 August 5. < https://
drupalsun.com/heine/2010/08/25/unserializing-user-supplied-data-bad-idea >.2023-04-07.
[REF-465]Manish S. Saindane. "Black Hat EU 2010 - Attacking Java Serialized Communication".
2010 April 6. < https://www.slideshare.net/msaindane/black-hat-eu-2010-attacking-java-serializedcommunication
>.2023-04-07.
[REF-466]Nadia Alramli. "Why Python Pickle is Insecure". 2009 September 9. < http://michaelrushanan.
blogspot.com/2012/10/why-python-pickle-is-insecure.html >.2023-04-07.
CWE Version 4.14
CWE-506: Embedded Malicious Code
CWE-506: Embedded Malicious Code