CVE-2022-45047
Apache MINA SSHD: Java unsafe deserialization vulnerability
Vexday Risk Score
48Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 9.8EPSS 3.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
16 Nov 2022Published on NVD
07 Apr 2023Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache MINA SSHDpublic PoCs found — 1
githubgithub.com/hktalent/CVE-2022-45047★ 2⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →