1. Home
  2. Vulnerabilities
  3. CVE-2022-36944

CVE-2022-36944

CVSS v3.1 9.8 (Critical)
98% Progress
EPSS 0.75 % (81th)
0.75% Progress
Affected Products 3
Advisories 3
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Weaknesses
CWE-502
Deserialization of Untrusted Data
CVE Status
PUBLISHED
CNA
MITRE
Published Date
2022-09-23 18:15:10
(2 years ago)
Updated Date
2023-11-07 03:49:42
(10 months ago)

Affected Products

Fedoraproject

Scala-lang

Configuration #1

    CPE23 From Up To
  Scala-lang Scala from 2.13.0 version and prior 2.13.9 version cpe:2.3:a:scala-lang:scala >= 2.13.0 < 2.13.9
  Scala-lang Scala-collection-compat prior 2.9.0 version cpe:2.3:a:scala-lang:scala-collection-compat < 2.9.0

Configuration #2

    CPE23 From Up To
  Fedoraproject Fedora 35 cpe:2.3:o:fedoraproject:fedora:35
  Fedoraproject Fedora 36 cpe:2.3:o:fedoraproject:fedora:36