-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Spring Batch's Jackson configuration enabling default typing in ObjectMapper when handling ExecutionContext serialization/deserialization. The Jackson2ExecutionContextStringSerializer class is directly responsible for this serialization mechanism. Default typing allows attackers to specify arbitrary classes during deserialization, which combined with write access to the data store (JobRepository), leads to code execution. The functions handling serialization/deserialization in this class are the primary vectors, as they implement the vulnerable Jackson configuration pattern.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.batch:spring-batch-core | maven | >= 4.0.0, <= 4.2.2 | 4.2.3 |