Critical severity · published Jun 10, 2022
CVE-2022-25845
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under…
9.8
CVSS
18.7%
EPSS
No
On KEV
Description
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)18.7% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Communications Cloud Native Core Unified Data Repository · Oracle
22.2.0 · source: NVD
FA
Fastjson · Alibaba
before 1.2.83 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25845
Patch
https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d
Patch
https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15
Release Notes
https://github.com/alibaba/fastjson/releases/tag/1.2.83
Third Party Advisory
https://github.com/alibaba/fastjson/wiki/security_update_20220523
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222
Exploit
https://www.ddosi.org/fastjson-poc/
More from Fastjson
10.0
CVE-2025-70974
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain…
9.8
CVE-2017-18349
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request,…
9.0
CVE-2026-16723
Remote Code Execution in fastjson 1.2.68–1.2.83