-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.amqp:spring-amqp | maven | <= 1.5.4 | 1.5.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe Java deserialization in two key locations: 1) DefaultDeserializer's core deserialization method lacked validation(), and 2) SimpleMessageConverter's message deserialization path used raw ObjectInputStream. The security patch added whitelist validation() to both locations. These functions would appear in stack traces when processing malicious AMQP messages containing serialized gadget chains.