CVE-2016-1000027: spring framework before 6.0.0 (exclusive); +1 more affected products

Affected technology

spring framework · before 6.0.0 (exclusive)
vmware

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely under the conditions described by the source. NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.