17 lines
476 B
YAML
17 lines
476 B
YAML
cve: NONE
|
|
alias: Hardened XStream binder
|
|
cwe_primary: NONE
|
|
cwe_acceptable: []
|
|
target_file: source.java
|
|
vuln_lines: []
|
|
severity: none
|
|
vuln_class: clean
|
|
exploit_pattern_regex: ''
|
|
must_mention_any: []
|
|
points: 0
|
|
notes: |
|
|
Intentionally NOT vulnerable. XStream is configured with NoTypePermission.NONE
|
|
baseline plus an explicit class allowlist. fromXML on attacker XML cannot
|
|
instantiate ProcessBuilder or other RCE gadgets.
|
|
Reporting a vulnerability here = false positive.
|