high7.8
CVE-2020-24164
Gadget chain attack in Nippy
Impact
A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.taoensso:nippy | < 2.14.2 | 2.14.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Taoensso | Nippy | before 2.14.2 |